{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,11]],"date-time":"2026-03-11T22:59:07Z","timestamp":1773269947948,"version":"3.50.1"},"publisher-location":"Singapore","reference-count":25,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819562022","type":"print"},{"value":"9789819562039","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-981-95-6203-9_13","type":"book-chapter","created":{"date-parts":[[2026,1,2]],"date-time":"2026-01-02T02:25:38Z","timestamp":1767320738000},"page":"235-252","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Enhancing Explainability in\u00a0X-IDS Through Counterfactuals"],"prefix":"10.1007","author":[{"given":"Quan","family":"Li","sequence":"first","affiliation":[]},{"given":"Yuhong","family":"Li","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,1,2]]},"reference":[{"key":"13_CR1","unstructured":"Kuypers, M.A., Maillart, T., Pat\u00e9-Cornell, E.: An empirical analysis of cyber security incidents at a large organization. Department of Management Science and Engineering, Stanford University, School of Information, UC Berkeley 30, 1\u201322 (2016). Accessed July"},{"key":"13_CR2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.121000","volume":"234","author":"MJ Idrissi","year":"2023","unstructured":"Idrissi, M.J., et al.: Fed-ANIDS: federated learning for anomaly-based network intrusion detection systems. Expert Syst. Appl. 234, 121000 (2023)","journal-title":"Expert Syst. Appl."},{"key":"13_CR3","doi-asserted-by":"publisher","first-page":"30164","DOI":"10.1109\/ACCESS.2024.3368377","volume":"12","author":"D Gaspar","year":"2024","unstructured":"Gaspar, D., Silva, P., Silva, C.: Explainable AI for intrusion detection systems: LIME and SHAP applicability on multi-layer perceptron. IEEE Access 12, 30164\u201330175 (2024)","journal-title":"IEEE Access"},{"key":"13_CR4","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.121751","volume":"238","author":"B Sharma","year":"2024","unstructured":"Sharma, B., Sharma, L., Lal, C., Roy, S.: Explainable artificial intelligence for intrusion detection in IoT networks: a deep learning based approach. Expert Syst. Appl. 238, 121751 (2024)","journal-title":"Expert Syst. Appl."},{"key":"13_CR5","doi-asserted-by":"publisher","unstructured":"Ribeiro, M.T., Singh, S., Guestrin, C.: \"Why should i trust you?\": explaining the predictions of any classifier. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1135\u20131144. KDD \u201916, Association for Computing Machinery, New York, NY, USA (2016). https:\/\/doi.org\/10.1145\/2939672.2939778","DOI":"10.1145\/2939672.2939778"},{"key":"13_CR6","unstructured":"Lundberg, S.M., Lee, S.I.: A unified approach to interpreting model predictions. In: Proceedings of the 31st International Conference on Neural Information Processing Systems, pp. 4768\u20134777. NIPS\u201917, Curran Associates Inc., Red Hook, NY, USA (2017)"},{"key":"13_CR7","doi-asserted-by":"publisher","unstructured":"Marino, D.L., Wickramasinghe, C.S., Manic, M.: An adversarial approach for explainable AI in intrusion detection systems. In: IECON 2018 - 44th Annual Conference of the IEEE Industrial Electronics Society, pp. 3237\u20133243. Washington, DC, USA (2018). https:\/\/doi.org\/10.1109\/IECON.2018.8591457","DOI":"10.1109\/IECON.2018.8591457"},{"key":"13_CR8","doi-asserted-by":"publisher","unstructured":"Burkart, N., Franz, M., Huber, M.: Explanation framework for intrusion detection. In: Beyerer, J., Maier, A., Niggemann, O. (eds.) Machine Learning for Cyber Physical Systems. Technologien f\u00fcr die intelligente Automation, vol.\u00a013, p.\u00a09. Springer Vieweg, Berlin, Heidelberg (2021). https:\/\/doi.org\/10.1007\/978-3-662-62746-4_9","DOI":"10.1007\/978-3-662-62746-4_9"},{"issue":"2","key":"13_CR9","first-page":"841","volume":"31","author":"S Wachter","year":"2018","unstructured":"Wachter, S., et al.: Counterfactual explanations without opening the black box: automated decisions and the GDPR. Harvard J. Law Technol. 31(2), 841\u2013887 (2018)","journal-title":"Harvard J. Law Technol."},{"key":"13_CR10","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.artint.2018.07.007","volume":"267","author":"T Miller","year":"2019","unstructured":"Miller, T.: Explanation in artificial intelligence: insights from the social sciences. Artif. Intell. 267, 1\u201338 (2019)","journal-title":"Artif. Intell."},{"issue":"1","key":"13_CR11","doi-asserted-by":"publisher","first-page":"1000","DOI":"10.1109\/TITS.2022.3188671","volume":"24","author":"A Oseni","year":"2023","unstructured":"Oseni, A.: An explainable deep learning framework for resilient intrusion detection in IoT-enabled transportation networks. IEEE Trans. Intell. Transp. Syst. 24(1), 1000\u20131014 (2023)","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"issue":"15","key":"13_CR12","doi-asserted-by":"publisher","first-page":"25454","DOI":"10.1109\/JIOT.2023.3327024","volume":"11","author":"A Aljuhani","year":"2024","unstructured":"Aljuhani, A., Alamri, A., Kumar, P., Jolfaei, A.: An intelligent and explainable SaaS-based intrusion detection system for resource-constrained IoMT. IEEE Internet Things J. 11(15), 25454\u201325463 (2024)","journal-title":"IEEE Internet Things J."},{"key":"13_CR13","doi-asserted-by":"crossref","unstructured":"S, P., V, V., et al.: Explainable artificial intelligence for intrusion detection system. Electronics 11(19), 3079 (2022)","DOI":"10.3390\/electronics11193079"},{"key":"13_CR14","unstructured":"Mane, S., Rao, D.: Explaining network intrusion detection system using explainable AI framework. ArXiv abs\/2103.07110 (2021)"},{"issue":"3","key":"13_CR15","doi-asserted-by":"publisher","first-page":"167","DOI":"10.1109\/LNET.2022.3186589","volume":"4","author":"P Barnard","year":"2022","unstructured":"Barnard, P., Marchetti, N., DaSilva, L.A.: Robust network intrusion detection through explainable artificial intelligence (XAI). IEEE Netw. Lett. 4(3), 167\u2013171 (2022)","journal-title":"IEEE Netw. Lett."},{"key":"13_CR16","doi-asserted-by":"publisher","unstructured":"Siganos, M., et al.: Explainable AI-based intrusion detection in the internet of things. In: Proceedings of the 18th International Conference on Availability, Reliability and Security. ARES \u201923, Association for Computing Machinery, New York, NY, USA (2023). https:\/\/doi.org\/10.1145\/3600160.3605162","DOI":"10.1145\/3600160.3605162"},{"key":"13_CR17","doi-asserted-by":"publisher","first-page":"23954","DOI":"10.1109\/ACCESS.2024.3365140","volume":"12","author":"O Arreche","year":"2024","unstructured":"Arreche, O., Guntur, T.R., Roberts, J.W., Abdallah, M.: E-XAI: Evaluating black-box explainable AI frameworks for network intrusion detection. IEEE Access 12, 23954\u201323988 (2024)","journal-title":"IEEE Access"},{"key":"13_CR18","doi-asserted-by":"publisher","unstructured":"Szczepa\u0144ski, M., Chora\u015b, M., Pawlicki, M., Kozik, R.: Achieving explainability of intrusion detection system by hybrid oracle-explainer approach. In: 2020 International Joint Conference on Neural Networks (IJCNN), pp.\u00a01\u20138. Glasgow, UK (2020). https:\/\/doi.org\/10.1109\/IJCNN48605.2020.9207199","DOI":"10.1109\/IJCNN48605.2020.9207199"},{"key":"13_CR19","doi-asserted-by":"publisher","unstructured":"Islam, S., Eberle, W.: Domain knowledge-aided explainable artificial intelligence. In: Ahmed, M., Islam, S., Anwar, A., Moustafa, N., Pathan, A. (eds.) Explainable Artificial Intelligence for Cyber Security. Studies in Computational Intelligence, vol.\u00a01025, p.\u00a04. Springer, Cham (2022). https:\/\/doi.org\/10.1007\/978-3-030-96630-0_4","DOI":"10.1007\/978-3-030-96630-0_4"},{"key":"13_CR20","doi-asserted-by":"publisher","first-page":"247","DOI":"10.1017\/S1358246100005130","volume":"27","author":"P Lipton","year":"1990","unstructured":"Lipton, P.: Contrastive explanation. R. Inst. Philos. Suppl. 27, 247\u2013266 (1990)","journal-title":"R. Inst. Philos. Suppl."},{"key":"13_CR21","doi-asserted-by":"publisher","unstructured":"Mothilal, R.K., Sharma, A., Tan, C.: Explaining machine learning classifiers through diverse counterfactual explanations. In: Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency. p. 607\u2013617. FAT* \u201920, Association for Computing Machinery, New York, NY, USA (2020). https:\/\/doi.org\/10.1145\/3351095.3372850","DOI":"10.1145\/3351095.3372850"},{"issue":"4","key":"13_CR22","doi-asserted-by":"publisher","first-page":"634","DOI":"10.1145\/285055.285059","volume":"45","author":"U Feige","year":"1998","unstructured":"Feige, U.: A threshold of ln n for approximating set cover. J. ACM 45(4), 634\u2013652 (1998)","journal-title":"J. ACM"},{"key":"13_CR23","doi-asserted-by":"crossref","unstructured":"Krause, A., Golovin, D.: Submodular Function Maximization, pp. 71\u2013104. Cambridge University Press (2014)","DOI":"10.1017\/CBO9781139177801.004"},{"key":"13_CR24","doi-asserted-by":"publisher","unstructured":"Moustafa, N., Slay, J.: UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 Network Data Set). In: Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS 2015), pp.\u00a01\u20136 (2015). https:\/\/doi.org\/10.1109\/MilCIS.2015.7348942","DOI":"10.1109\/MilCIS.2015.7348942"},{"issue":"1\u20133","key":"13_CR25","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1080\/19393555.2015.1125974","volume":"25","author":"N Moustafa","year":"2016","unstructured":"Moustafa, N., Slay, J.: The evaluation of network anomaly detection systems: statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set. Inf. Secur. J. Glob. Perspect. 25(1\u20133), 18\u201331 (2016)","journal-title":"Inf. Secur. J. Glob. Perspect."}],"container-title":["Lecture Notes in Computer Science","Information Security and Cryptology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-95-6203-9_13","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,11]],"date-time":"2026-03-11T07:36:29Z","timestamp":1773214589000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-95-6203-9_13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9789819562022","9789819562039"],"references-count":25,"URL":"https:\/\/doi.org\/10.1007\/978-981-95-6203-9_13","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"2 January 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"Inscrypt","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Information Security and Cryptology","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Xi'an","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19 October 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19 October 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"cisc22025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/inscrypt2025.xidian.edu.cn\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}