Deep Learning for Cyber Threat Detection and Mitigation in Healthcare-IoT

Mirza Akhi

REVIEW 3 major objections 4 minor 1 references

A lightweight Temporal Convolutional Network can detect and mitigate DDoS attacks in simulated healthcare-IoT networks with reported accuracy above 99.9% by watching per-node message frequency, then run quantized on a Raspberry Pi 4.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 01:14 UTC pith:6BN7DK64

load-bearing objection Useful datasets and an honest deployment study, but the headline accuracy is a measure of the labeling rule, not independent DDoS detection. the 3 major comments →

arxiv 2608.00118 v1 pith:6BN7DK64 submitted 2026-07-31 cs.CR cs.LGeess.SP

Deep Learning for Cyber Threat Detection and Mitigation in Healthcare-IoT

Mirza Akhi This is my paper

classification cs.CR cs.LGeess.SP

keywords healthcare-IoT securityDDoS detectiontemporal convolutional networkedge deploymentMQTTUDPintrusion detection datasetsmulticlass attack classification

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This thesis claims that the most informative sign of a DDoS attack in a healthcare-IoT network is the message transmission frequency of each node: normal sensors transmit at regular intervals while attack nodes transmit far more often. On that basis the author builds three simulated datasets — MQTT traffic from Cooja, UDP traffic from ns-3, and a combined multi-attack set — and shows that a Temporal Convolutional Network trained on frequency-derived features identifies malicious nodes with reported accuracy above 99.9%, beating BiLSTM and CNN, and that a dynamic threshold can blacklist detected nodes. The paper further claims that the quantized model runs in real time on a Raspberry Pi 4 at low latency and power, making edge deployment feasible, and that a residual variant (Res-TCN) can separate DDoS, selective forwarding, and man-in-the-middle attacks in one multiclass model. A sympathetic reader would care because, if true, a small, fast network placed near the medical data sink could replace heavyweight cloud-based detectors in resource-constrained settings.

Core claim

On the paper's own terms, the discovery is that per-node transmission frequency is a sufficient signature for DDoS activity in healthcare IoT. Malicious nodes are simulated to transmit at shorter intervals than normal nodes; the TCN ingests features such as total messages per node, message frequency proportion, and a 5-second monitoring frequency, and labels each node as malicious or normal. The same recipe works across two protocol families: MQTT (Cooja) and UDP (ns-3, 5G-enabled), with reported accuracies of 99.98% and 99.99% respectively, outperforming BiLSTM and CNN baselines. Quantization to TensorFlow Lite shrinks the model for a Raspberry Pi 4 deployment with low latency and power con

What carries the argument

The central object is the Temporal Convolutional Network (TCN) — a convolutional architecture with dilated causal convolutions that processes time-ordered features in parallel rather than sequentially — trained on frequency features computed per node: total messages, per-node message counts, message frequency proportion, monitoring frequency, and running mean frequency. The detection signal is the monitoring frequency of each node; the mitigation mechanism is a dynamic threshold that blacklists nodes whose monitored behaviour matches the malicious pattern. In the multi-attack setting the companion is a Residual TCN (Res-TCN), which adds skip connections for stable training on combined physio

Load-bearing premise

The load-bearing premise is that the frequency rules are valid ground truth for DDoS: in the UDP dataset a node is labelled malicious when its 5-second monitoring frequency meets or exceeds the running mean frequency, and in the MQTT dataset when its message frequency proportion exceeds 5% (Sections 3.4.2, 3.4.4, and 4.8). If those rules do not independently correspond to real attack activity, the near-perfect accuracy largely reflects the model learning the labelling rule, s

What would settle it

A decisive check: apply the labelling rules directly as a detector, with no trained model — label a node malicious whenever its monitoring frequency is at least the running mean (UDP) or its frequency proportion exceeds 5% (MQTT) — and measure accuracy on the same train/test splits. If this rule-only baseline already reaches the reported 99.9+% figures, the TCN adds no detection power beyond the rule. A second check: evaluate the trained TCN on a dataset labelled by actual attack injection rather than by the frequency rule; if accuracy collapses, the model learned the rule, not the attack.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

If the frequency-based claim is right, DDoS detection in H-IoT does not need heavyweight recurrent networks; a compact TCN that processes time-ordered features in parallel can do the job within wearable-device budgets.
The same detection-and-blacklist loop could run at the edge, next to the medical data sink, rather than depending on cloud connectivity — relevant for clinics and remote monitoring where the network link is itself the target.
Because the mechanism transfers across MQTT and UDP, a single TCN design may cover several IoT protocol stacks without architectural change.
The multiclass Res-TCN result implies that one model can distinguish DDoS, selective forwarding, and man-in-the-middle behaviours in a single topology, which is closer to the mixed-threat reality of deployed networks.
The released datasets give the community node-level, temporal, protocol-specific benchmarks that aggregated traffic datasets do not provide, enabling fairer comparison of detection models.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

My inference: the reported accuracy is likely dominated by the labelling rule itself — in the UDP dataset a node is labelled malicious exactly when its 5-second monitoring frequency reaches the running mean, and the model is trained on those same frequency features, so the 99.99% figure may measure how well the network reproduces that rule rather than how well it detects attacks.
My inference: because attack behaviour is simulated with fixed transmission intervals (e.g., 20 s versus 60 s), the frequency signature is cleanly separable by design; real DDoS traffic with variable, randomized, or slow-and-low rates would probably erode the margin, so the headline numbers are best read as upper bounds for the simulated regime.
My inference: a natural test is to compare the TCN against a parameter-free baseline — classify a node as malicious whenever its monitored frequency equals or exceeds the running mean (or its frequency proportion exceeds 5% for MQTT), since that rule, not the learned model, generates the labels; if the baseline matches TCN accuracy, the contribution is engineering for efficient edge deployment rat

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

Useful datasets and an honest deployment study, but the headline accuracy is a measure of the labeling rule, not independent DDoS detection.

read the letter

Dear colleague,

The thing to know about arXiv:2608.00118 is that it is a compilation PhD thesis, not a new research paper. Its genuinely useful parts are the three synthetic H-IoT datasets (with DOIs on Zenodo) and the Raspberry Pi 4 TFLite deployment measurements. The headline claim—TCN/Res-TCN detecting DDoS at ~99.99% accuracy—is not supported by the evaluation as described.

What the paper does well: the datasets are documented in detail, the preprocessing scripts are included, and the authors are upfront about the simulation-based nature and the labeling rules. The edge deployment numbers (latency, power) are concrete and reproducible. That is real work.

The soft spot is load-bearing. For the UDP dataset, the label is assigned when the 5-second monitoring frequency is ≥ the running mean frequency (Section 3.4.4). For MQTT, nodes exceeding a 5% frequency proportion are flagged (Section 3.4.2). The TCN's input features include those exact monitoring frequencies and means. So the near-perfect accuracy is exactly what you'd expect if the network learned the same threshold rule. The external validation on CICIoT2023 etc. is mentioned but the results are not shown in this text, so I can't judge it. The thesis itself doesn't hide this—it describes the mechanism as a 'frequency monitoring based detection', which is a fair description, but the evaluation treats the rule's output as ground truth rather than as part of the detector.

The authors should reframe the contribution: the model is a learned implementation of a frequency-based detector, not an independently validated DDoS detector. Or they need to show results on public datasets with independent labels, which may exist in the published versions.

Who gets value from this? People looking for node-level H-IoT traffic datasets with a known simulation setup, and anyone wanting a worked example of quantized TFLite deployment on a Pi. As a strong claim about attack detection, it needs major revision.

For peer review: I'd send it to referees—the datasets and deployment work deserve scrutiny, and the circularity is fixable—but I would not accept the detection claim as stated.

Best.

Referee Report

3 major / 4 minor

Summary. The manuscript is a PhD thesis-style paper that develops synthetic healthcare-IoT (H-IoT) attack datasets and proposes lightweight deep learning models for cyber threat detection and mitigation. It introduces three datasets: UL-ECE-MQTT-DDoS-H-IoT2025 and UL-ECE-UDP-DDoS-H-IoT2025 for binary DDoS detection, and UL-ECE-MultiAttack-H-IoT2025 for multiclass detection of DDoS, selective forwarding, and man-in-the-middle attacks. The central detection claim is that a Temporal Convolutional Network (TCN) can detect DDoS attacks at node level with near-perfect accuracy on the authors' own MQTT and UDP datasets, and that a quantized TFLite version runs efficiently on a Raspberry Pi 4. A residual variant (Res-TCN) is proposed for multiclass detection. The paper also reports comparisons with BiLSTM, CNN, and decision-tree baselines, and describes edge deployment experiments with power and latency measurements.

Significance. If the detection claims were valid, the paper would offer a genuinely useful contribution: a lightweight TCN with ~99.9% accuracy for node-level DDoS detection in resource-constrained H-IoT settings, plus a reproducible dataset-generation pipeline and concrete edge-deployment measurements. The thesis is transparent about its simulation-based approach and includes publicly archived datasets and preprocessing scripts, which are strengths for reproducibility. The Raspberry Pi 4 power and latency data, and the TFLite quantization workflow, are valuable practical artifacts. However, the core detection claim is not independently supported by the visible evidence because the ground-truth labels are generated by frequency-based rules and the model input includes the very same frequency features. This circularity means the reported near-perfect accuracy primarily measures consistency with the labeling rule rather than an independent ability to detect DDoS activity. The external validation on CICIoT2023 and similar datasets is cited but the full results are not visible in the provided text, so the in-scope evidence for the headline claim rests on the self-labelled datasets.

major comments (3)

[Section 3.4.4 / Section 4.5.3.13] The UDP dataset is labelled by the rule: if the 5-second monitoring frequency is greater than or equal to the running mean frequency, the record is malicious (Section 3.4.4). The TCN input includes monitoring frequency and mean frequency as features (Sections 4.5.3.9, 4.5.3.10, 4.5.3.13). Thus the label is a deterministic function of the input features. The reported 99.99% accuracy on this dataset is exactly what would be expected from learning that threshold, and does not establish independent DDoS detection. This is a load-bearing issue: the paper's central claim that TCN 'uses monitoring frequency to accurately identify malicious nodes' is not supported by an evaluation protocol that shares the labeling rule with the model's features. The authors should re-label using the known attack-node configuration from the ns-3 simulator (which nodes were actually programmed as attackers) rather
[Sections 3.4.2 and 4.8] The MQTT dataset is labelled by flagging nodes that exceed a 5% message-frequency proportion as malicious, and the 'frequency' feature is included in the model input (Section 4.4.3.5). Table 3.2 shows that malicious nodes have frequency values above 10% while normal nodes are mostly below 6%, so the classes are nearly linearly separable by the threshold itself. The TCN's reported 99.98% accuracy is therefore consistent with learning this 5% rule rather than discovering attack behaviour. Section 4.8 explicitly acknowledges 'Threshold-Based Labelling in the MQTT Dataset', which confirms that the labels are derived from the same feature used for prediction. This circularity undermines the detection claim for the MQTT dataset as well.
[Section 5.5.4 / Section 6.6.4] The external validation on public datasets (CICIoT2023, CICIIoT2025, CICIoMT2024, IoMT-TrafficData) is described in prose and summaries, but the detailed performance numbers are not visible in the provided manuscript text. Since the self-generated datasets are subject to the circularity described above, the external validation is the only potential source of independent evidence for the detection claim. The authors should present complete confusion matrices and per-class results for these public datasets in a form that can be checked by the reader, ideally with a description of how the TCN input features were constructed from those datasets and whether the features overlap with the label-generation process.

minor comments (4)

[Table 3.6] The comparison in Table 3.6 mixes different models (RF, DT, CNN, TCN) and different datasets; the accuracy values are not directly comparable. It should be clearly stated that these are reported accuracies from the cited studies, not a controlled comparison under identical training settings.
[Chapter 3] The equations in Sections 3.4.2 and 3.4.4 are labelled with Roman numerals (i), (ii), (iii) rather than numbered conventions used elsewhere. This makes cross-referencing difficult. Also, the terms 'total messages same node' and 'monitoring total messages same node' are not formally distinguished until later in Chapter 4; defining them earlier would improve readability.
[Multiple sections] The thesis contains a small number of grammatical errors and inconsistent hyphenation (e.g., '5G-enabled H-IoT', 'healthcare-IoT'). These do not affect the technical content but should be polished in a final revision.
[Section 3.6] The limitations section correctly notes that simulation-based data may not reflect real-world variability. However, it does not mention the more specific and consequential limitation that the labels are derived from the same frequency features used for detection. Adding this explicitly would make the evaluation protocol easier to assess.

Circularity Check

2 steps flagged

UDP and MQTT 'malicious' labels are defined by the same frequency features fed to the TCN, so the reported near-perfect accuracy largely re-learns the labelling rule.

specific steps

self definitional [Section 3.4.4 (UDP labelling rule); features listed in Table 3.4 and Sections 4.5.3.9, 4.5.3.10, 4.5.3.13]
"If the 5-second monitoring frequency is greater than or equal to the running mean frequency, the labelling rule assigns a binary outcome label, malicious = 1 and normal = 0."

The label is defined as the condition monitoring_frequency >= running_mean_frequency. Both quantities are among the 13 selected features used to train the TCN (Table 3.4: 'Frequency', 'Mean Frequency', 'Monitoring Frequency'; Section 4.5.3.9-4.5.3.13). Therefore every record's label is a deterministic function of the model inputs. A TCN (or almost any classifier) can reproduce this inequality, so its reported 99.99% accuracy on the UDP dataset is a check of label-feature redundancy, not independent evidence that the model detects DDoS.
self definitional [Section 3.4.2 (MQTT labelling); Section 4.4.3.5 (Message Frequency Proportion feature)]
"This feature plays a crucial role in identifying DDoS-affected nodes, as an abnormally high frequency value may indicate anomalous or malicious behaviour. A threshold-based mechanism is applied to flag nodes that exceed a frequency of 5%, as illustrated in the sample dataset provided in Table 3.2."

For MQTT, the 'malicious' label is a threshold on the 'Message Frequency Proportion (frequency)' feature, and the same frequency proportion is one of the four features supplied to the TCN (Section 4.4.3.5). Hence the 99.98% detection accuracy can be achieved by learning the 5% cutoff itself; it does not establish that the model identifies attack behaviour independent of the threshold that generated the labels.

full rationale

The central DDoS-detection claim is evaluated on two datasets whose ground-truth labels are generated from thresholds on transmission-frequency features. The UDP pipeline labels a record malicious exactly when the 5-second monitoring frequency is at least the running mean frequency; the MQTT pipeline labels nodes exceeding a 5% frequency proportion as malicious. These same quantities (frequency, mean frequency, monitoring frequency, total messages, etc.) are the TCN's input features. As a result, the near-perfect accuracies are the expected outcome of fitting a rule that is already encoded in the labels, and they cannot by themselves validate DDoS detection beyond that rule. The thesis references cross-dataset evaluations on CICIoT2023/CICIIoT2025 and CICIoMT2024 as external support, but those results are only listed/mentioned in the provided text, not presented with enough detail to repair the internal evaluation protocol. This is therefore a definitional/circular evaluation issue rather than a mere disagreement with external consensus; the reported detection accuracy on the primary datasets reduces, by construction, to the labelling rule. No separate self-citation chain is load-bearing here, so the score is 8 rather than 10.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The central claim rests on two synthetic datasets whose labels are generated by hand-picked frequency rules, plus a simulation-fidelity assumption. The TCN consumes the same frequency features that define the labels, so accuracy on the authors' own data is not an independent test. No new physical entities are introduced.

free parameters (3)

MQTT message-frequency threshold = 5%
Used in Section 3.4.2 to flag nodes as malicious; a hand-chosen cutoff, not derived from external data. Accuracy on the MQTT dataset is partly a measure of this cutoff.
UDP monitoring window = 5 seconds
Chosen for the sliding-window aggregation in Section 3.4.4; the window determines the monitoring-frequency features and the labels.
TCN hyperparameters = dropout/learning rate selected by ablation (Tables 4.9-4.10)
Model configuration is tuned on the same datasets; part of the fitting burden, though not the central circularity.

axioms (4)

domain assumption Cooja/ns-3 simulations with fixed transmission intervals (e.g., normal 60 s vs malicious 20 s) are a faithful proxy for real H-IoT traffic
The 'realistic dataset' claim depends on this; Section 3.6 concedes simulated data may not capture real-world variability.
domain assumption DDoS attack behavior is sufficiently represented by higher message frequency
The frequency-monitoring detection mechanism in Chapter 4 assumes malicious nodes are distinguishable by send rate alone.
ad hoc to paper UDP ground truth is defined by '5-s monitoring frequency >= running mean frequency'
Section 3.4.4 defines labels with this rule; since the model uses the same features, evaluation against these labels is partially circular.
ad hoc to paper MQTT ground truth is defined by exceeding a 5% frequency proportion
Section 3.4.2; the 5% cutoff is uncalibrated against any external attack definition.

pith-pipeline@v1.3.0-alltime-deepseek · 48296 in / 14411 out tokens · 150476 ms · 2026-08-04T01:14:19.525435+00:00 · methodology

0 comments

read the original abstract

Cybersecurity is a fundamental requirement for protecting wearable devices used in healthcare Internet of Things (H-IoT) systems. Security failures in these resource-constrained systems directly compromise patient safety. Physiological data and network traffic are frequent targets of cyberattacks in H-IoT environments. To address these risks, deep learning-based cybersecurity mechanisms for H-IoT often involve complex architectures with large parameter counts. Existing datasets are also rarely assessed for quality, limiting their applicability. However, this research addresses these challenges by developing multiple realistic datasets and proposing lightweight deep learning models, namely the Temporal Convolutional Network (TCN) and Residual TCN (Res-TCN), for H-IoT. It includes two binary classification datasets for Distributed Denial of Service (DDoS) attacks and a multiclass dataset representing Selective Forwarding (SF), Man-in-the-Middle (MITM), and DDoS attacks. The datasets UL-ECE-MQTT-DDoS-H-IoT2025 and UL-ECE-UDP-DDoS-H-IoT2025 are generated in Cooja and ns-3 to capture transmission behaviours and protocol variations. The third dataset, UL-ECE-MultiAttack-H-IoT2025, integrates physiological and network features to represent multiple cyber threats in H-IoT. Building on this, the TCN model is designed to detect and mitigate DDoS attacks over the MQTT and UDP-based datasets. It incorporates a monitoring frequency-based detection mechanism and a dynamic threshold-based mitigation strategy. To enable edge deployment, the model is quantised and converted into TensorFlow Lite (TFLite) for real-time DDoS detection on Raspberry Pi 4, achieving low latency and power-efficient operation in H-IoT. This thesis establishes a deep learning-based cybersecurity defence mechanism encompassing realistic dataset generation, lightweight model design, and edge deployment for securing H-IoT systems.

Figures

Figures reproduced from arXiv: 2608.00118 by Mirza Akhi.

**Figure 1.** Figure 1 [PITH_FULL_IMAGE:figures/full_fig_p032_1.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p038_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p043_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p045_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p046_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p049_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p052_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p054_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p058_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p060_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p064_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p067_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p072_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p073_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p078_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p081_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p083_2.png] view at source ↗

**Figure 2.** Figure 2 [PITH_FULL_IMAGE:figures/full_fig_p085_2.png] view at source ↗

**Figure 3.** Figure 3 [PITH_FULL_IMAGE:figures/full_fig_p105_3.png] view at source ↗

**Figure 3.** Figure 3 [PITH_FULL_IMAGE:figures/full_fig_p106_3.png] view at source ↗

**Figure 3.** Figure 3 [PITH_FULL_IMAGE:figures/full_fig_p108_3.png] view at source ↗

**Figure 4.** Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p115_4.png] view at source ↗

**Figure 4.** Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p127_4.png] view at source ↗

**Figure 4.** Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p128_4.png] view at source ↗

**Figure 4.** Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p130_4.png] view at source ↗

**Figure 4.** Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p138_4.png] view at source ↗

**Figure 4.** Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p146_4.png] view at source ↗

**Figure 4.** Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p157_4.png] view at source ↗

**Figure 5.** Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p174_5.png] view at source ↗

**Figure 5.** Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p182_5.png] view at source ↗

**Figure 5.** Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p185_5.png] view at source ↗

**Figure 5.** Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p190_5.png] view at source ↗

**Figure 5.** Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p191_5.png] view at source ↗

**Figure 5.** Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p195_5.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p212_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p225_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p227_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p229_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p230_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p244_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p246_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p252_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p257_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p258_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p260_6.png] view at source ↗

**Figure 6.** Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p261_6.png] view at source ↗

discussion (0)

Reference graph

Works this paper leans on

1 extracted references

[1]

A perspective on explainable artificial intelligence methods: Shap and lime,

[519] A. M. Salih, Z. Raisi-Estabragh, I. B. Galazzo, et al. , “A perspective on explainable artificial intelligence methods: Shap and lime,” Advanced In- telligent Systems , vol. 7, no. 1, p. 2 400 304, 2025 (cit. on p. 260). 325

2025

[1] [1]

A perspective on explainable artificial intelligence methods: Shap and lime,

[519] A. M. Salih, Z. Raisi-Estabragh, I. B. Galazzo, et al. , “A perspective on explainable artificial intelligence methods: Shap and lime,” Advanced In- telligent Systems , vol. 7, no. 1, p. 2 400 304, 2025 (cit. on p. 260). 325

2025