{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,15]],"date-time":"2026-04-15T20:51:56Z","timestamp":1776286316159,"version":"3.50.1"},"reference-count":53,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2022,10,25]],"date-time":"2022-10-25T00:00:00Z","timestamp":1666656000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["BDCC"],"abstract":"<jats:p>Artificial intelligence (AI) and machine learning (ML) models have become essential tools used in many critical systems to make significant decisions; the decisions taken by these models need to be trusted and explained on many occasions. On the other hand, the performance of different ML and AI models varies with the same used dataset. Sometimes, developers have tried to use multiple models before deciding which model should be used without understanding the reasons behind this variance in performance. Explainable artificial intelligence (XAI) models have presented an explanation for the models\u2019 performance based on highlighting the features that the model considered necessary while making the decision. This work presents an analytical approach to studying the density functions for intrusion detection dataset features. The study explains how and why these features are essential during the XAI process. We aim, in this study, to explain XAI behavior to add an extra layer of explainability. The density function analysis presented in this paper adds a deeper understanding of the importance of features in different AI models. Specifically, we present a method to explain the results of SHAP (Shapley additive explanations) for different machine learning models based on the feature data\u2019s KDE (kernel density estimation) plots. We also survey the specifications of dataset features that can perform better for convolutional neural networks (CNN) based models.<\/jats:p>","DOI":"10.3390\/bdcc6040126","type":"journal-article","created":{"date-parts":[[2022,10,25]],"date-time":"2022-10-25T12:29:45Z","timestamp":1666700985000},"page":"126","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":63,"title":["Explaining Intrusion Detection-Based Convolutional Neural Networks Using Shapley Additive Explanations (SHAP)"],"prefix":"10.3390","volume":"6","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8864-2803","authenticated-orcid":false,"given":"Remah","family":"Younisse","sequence":"first","affiliation":[{"name":"Department of Computer Science\/Cybersecurity, Princess Sumaya University for Technology (PSUT), Amman 11941, Jordan"}]},{"given":"Ashraf","family":"Ahmad","sequence":"additional","affiliation":[{"name":"Department of Computer Science\/Cybersecurity, Princess Sumaya University for Technology (PSUT), Amman 11941, Jordan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2422-0297","authenticated-orcid":false,"given":"Qasem","family":"Abu Al-Haija","sequence":"additional","affiliation":[{"name":"Department of Computer Science\/Cybersecurity, Princess Sumaya University for Technology (PSUT), Amman 11941, Jordan"}]}],"member":"1968","published-online":{"date-parts":[[2022,10,25]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Abu Al-Haija, Q., and Al-Badawi, A. (2022). Attack-Aware IoT Network Traffic Routing Leveraging Ensemble Learning. Sensors, 22.","DOI":"10.3390\/s22010241"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Ring, M., Wunderlich, S., Scheuring, D., Landes, D., and Hotho, A. (2019). A Survey of Network-Based Intrusion Detection Data Sets, Computers & Security, Elsevier.","DOI":"10.1016\/j.cose.2019.06.005"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Le, T.-T.-H., Kim, H., Kang, H., and Kim, H. (2022). Classification and Explanation for Intrusion Detection System Based on Ensemble Trees and SHAP Method. Sensors, 22.","DOI":"10.3390\/s22031154"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"6634811","DOI":"10.1155\/2021\/6634811","article-title":"Explainable artificial intelligence (XAI) to enhance trust management in intrusion detection systems using decision tree model","volume":"2021","author":"Mahbooba","year":"2021","journal-title":"Complexity"},{"key":"ref_5","first-page":"8167821","article-title":"From Blackbox to Explainable AI in Healthcare: Existing Tools and Case Studies","volume":"2022","author":"Srinivasu","year":"2022","journal-title":"Mob. Inform. Syst."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"5140148","DOI":"10.1155\/2022\/5140148","article-title":"Explainable AI in Diagnosing and Anticipating Leukemia Using Transfer Learning Method","volume":"2022","author":"Abir","year":"2022","journal-title":"Comput. Intell. Neurosci."},{"key":"ref_7","unstructured":"Dieber, J., and Sabrina, K. (2020). Why model why? Assessing the strengths and limitations of LIME. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Neupane, S., Ables, J., Anderson, W., Mittal, S., Rahimi, S., Banicescu, I., and Seale, M. (2022). Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities. arXiv.","DOI":"10.1109\/ACCESS.2022.3216617"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Islam, S.R., Eberle, W., Ghafoor, S.K., and Ahmed, M. (2021). Explainable artificial intelligence approaches: A survey. arXiv.","DOI":"10.1007\/978-3-030-96630-0_4"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Alahmed, S., Alasad, Q., Hammood, M.M., Yuan, J.-S., and Alawad, M. (2022). Mitigation of Black-Box Attacks on Intrusion Detection Systems-Based ML. Computers, 11.","DOI":"10.3390\/computers11070115"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"752558","DOI":"10.3389\/frai.2021.752558","article-title":"SHAP and LIME: An evaluation of discriminative power in credit risk","volume":"4","author":"Gramegna","year":"2021","journal-title":"Front. Artif. Intell."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Jesus, S., Bel\u00e9m, C., Balayan, V., Bento, J., Saleiro, P., Bizarro, P., and Gama, J. (2021, January 3\u201310). How can I choose an explainer? An application-grounded evaluation of post-hoc explanations. Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, Virtual Event Canada.","DOI":"10.1145\/3442188.3445941"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"100572","DOI":"10.1016\/j.accinf.2022.100572","article-title":"Explainable Artificial Intelligence (XAI) in auditing","volume":"46","author":"Zhang","year":"2022","journal-title":"Int. J. Account. Inf. Syst."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"eaay7120","DOI":"10.1126\/scirobotics.aay7120","article-title":"XAI\u2014Explainable artificial intelligence","volume":"4","author":"Gunning","year":"2019","journal-title":"Sci. Robot."},{"key":"ref_15","unstructured":"Lundberg, S. (2022, June 01). An Introduction to Explainable AI with Shapley Values. Available online: https:\/\/shap.readthedocs.io\/en\/latest\/overviews.html."},{"key":"ref_16","unstructured":"Ribeiro, M.T. (2022, May 22). Local Interpretable Model-Agnostic Explanations (Lime). Available online: https:\/\/lime-ml.readthedocs.io\/en\/latest\/."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Ahmed, I., Kumara, I., Reshadat, V., Kayes, A.S.M., van den Heuvel, W.-J., and Tamburri, D.A. (2022). Travel Time Prediction and Explanation with Spatio-Temporal Features: A Comparative Study. Electronics, 11.","DOI":"10.3390\/electronics11010106"},{"key":"ref_18","unstructured":"Nurcan, S., and Korthaus, A. (2021). Evaluating Fidelity of Explainable Methods for Predictive Process Analytics. Intelligent Information Systems, Springer."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Kumara, I., Ariz, M.H., Chhetri, M.B., Mohammadi, M., van Den Heuvel, W.-J., and Tamburri, D.A. (2022, January 10\u201316). FOCloud: Feature Model Guided Performance Prediction and Explanation for Deployment Configurable Cloud Applications. Proceedings of the 2022 IEEE World Congress on Services (SERVICES), Barcelona, Spain.","DOI":"10.1109\/SERVICES55459.2022.00032"},{"key":"ref_20","unstructured":"Roberts, C.V., Ehtsham, E., and Ashok, C. (2022). On the Bias-Variance Characteristics of LIME and SHAP in High Sparsity Movie Recommendation Explanation Tasks. arXiv."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Panati, C., Wagner, S., and Br\u00fcggenwirth, S. (2022, January 12\u201314). Feature Relevance Evaluation using Grad-CAM, LIME and SHAP for Deep Learning SAR Data Classification. Proceedings of the 2022 23rd International Radar Symposium (IRS), Gdansk, Poland.","DOI":"10.23919\/IRS54158.2022.9904989"},{"key":"ref_22","unstructured":"Brent, M., Chris, R., and Sandra, W. (2019, January 29\u201331). Explaining Explanations in AI. Proceedings of the Conference on Fairness, Accountability, and Transparency (FAT* \u201919), Atlanta, GA, USA."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"441","DOI":"10.1007\/s11023-019-09502-w","article-title":"The Pragmatic Turn in Explainable Artificial Intelligence (XAI)","volume":"29","year":"2019","journal-title":"Minds Mach."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"101666","DOI":"10.1016\/j.giq.2021.101666","article-title":"The perils and pitfalls of explainable AI: Strategies for explaining algorithmic decision-making","volume":"39","author":"Warnier","year":"2022","journal-title":"Gov. Inf. Q."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1164","DOI":"10.1109\/OJCOMS.2022.3188750","article-title":"Why Should I Trust Your IDS?: An Explainable Deep Learning Framework for Intrusion Detection Systems in the Internet of Things Networks","volume":"3","author":"Houda","year":"2022","journal-title":"IEEE Open J. Commun. Soc."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"500","DOI":"10.1109\/TIFS.2013.2242890","article-title":"SVM Training Phase Reduction Using Dataset Feature Filtering for Malware Detection","volume":"8","author":"Sezer","year":"2013","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"106250","DOI":"10.1016\/j.asoc.2020.106250","article-title":"A one-class classification decision tree based on kernel density estimation","volume":"91","author":"Itani","year":"2020","journal-title":"Appl. Soft Comput."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"2339","DOI":"10.1109\/TIFS.2022.3183390","article-title":"An Explainable AI-Based Intrusion Detection System for DNS over HTTPS (DoH) Attacks","volume":"17","author":"Zebin","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_29","unstructured":"Syed, W., and Irfan, K. (2021). Explainable signature-based machine learning approach for identification of faults in grid-connected photovoltaic systems. arXiv."},{"key":"ref_30","unstructured":"Michalopoulos, P. (2020). Comparing Explanations for Black-Box Intrusion Detection Systems. [Master\u2019s Thesis, Mathematics and Computer Science Department, Eindhoven University of Technology]."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Schlegel, U., Arnout, H., El-Assady, M., Oelke, D., and Keim, D.A. (2019, January 27\u201328). Towards a rigorous evaluation of Xai methods on time series. Proceedings of the 2019 IEEE\/CVF International Conference on Computer Vision Workshop (ICCVW), Seoul, Korea.","DOI":"10.1109\/ICCVW.2019.00516"},{"key":"ref_32","first-page":"329","article-title":"Who is afraid of black box algorithms? On the epistemological and ethical basis of trust in medical AI","volume":"47","author":"Jongsma","year":"2021","journal-title":"J. Med. Ethics"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"303","DOI":"10.18280\/isi.260307","article-title":"Classification and Analysis of Malicious Traffic with Multi-layer Perceptron Model","volume":"26","author":"Khedkar","year":"2021","journal-title":"Ing\u00e9nierie Syst. d\u2019Inf."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Abuomar, O., and Sogbe, P. (2021, January 9\u201310). Classification and Detection of Chronic Kidney Disease (CKD) Using Machine Learning Algorithms. Proceedings of the 2021 International Conference on Electrical, Computer and Energy Technologies (ICECET), Cape Town, South Africa.","DOI":"10.1109\/ICECET52533.2021.9698666"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Hasan, M.J., Sohaib, M., and Kim, J.M. (2021). An Explainable AI-Based Fault Diagnosis Model for Bearings. Sensors, 21.","DOI":"10.3390\/s21124070"},{"key":"ref_36","unstructured":"Shraddha, M., and Dattaraj, R. (2021). Explaining Network Intrusion Detection System Using Explainable AI Framework. arXiv."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"537","DOI":"10.1108\/IJWIS-03-2021-0022","article-title":"Improving the performance of the intrusion detection systems by the machine learning explainability","volume":"17","author":"Dang","year":"2021","journal-title":"Int. J. Web Inf. Syst."},{"key":"ref_38","first-page":"012043","article-title":"Network intrusion detection: A comparative study of four classifiers using the NSL-KDD and KDD\u201999 datasets","volume":"2161","author":"Devarakonda","year":"2022","journal-title":"J. Physics: Conf. Ser."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"102861","DOI":"10.1016\/j.cose.2022.102861","article-title":"Comparative Research on Network Intrusion Detection Methods Based on Machine Learning","volume":"121","author":"Zhang","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Abu Al-Haija, Q., and Zein-Sabatto, S. (2020). An Efficient Deep-Learning-Based Detection and Classification System for Cyber-Attacks in IoT Communication Networks. Electronics, 9.","DOI":"10.20944\/preprints202011.0508.v2"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"481","DOI":"10.1049\/cit2.12123","article-title":"Feature-based augmentation and classification for tabular data","volume":"7","author":"Sathianarayanan","year":"2022","journal-title":"CAAI Trans. Intell. Technol."},{"key":"ref_42","unstructured":"Ahsan, H. (2022). A Study on How Data Quality Influences Machine Learning Predictability and Interpretability for Tabular Data. [Ph.D. Dissertation, Youngstown State University]."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Holzinger, A., Goebel, R., Fong, R., Moon, T., M\u00fcller, K.R., and Samek, W. (2022). Explaining the Predictions of Unsupervised Learning Models. xxAI\u2014Beyond Explainable AI, Springer.","DOI":"10.1007\/978-3-031-04083-2"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Patil, S., Varadarajan, V., Mazhar, S.M., Sahibzada, A., Ahmed, N., Sinha, O., Kumar, S., Shaw, K., and Kotecha, K. (2022). Explainable Artificial Intelligence for Intrusion Detection System. Electronics, 11.","DOI":"10.3390\/electronics11193079"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"61","DOI":"10.31026\/j.eng.2022.05.05","article-title":"Performance Analysis of different Machine Learning Models for Intrusion Detection Systems","volume":"28","author":"Hussein","year":"2022","journal-title":"J. Eng."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"e232","DOI":"10.1002\/itl2.232","article-title":"Intrusion detection systems using classical machine learning techniques vs. integrated unsupervised feature learning and deep neural network","volume":"5","author":"Rawat","year":"2022","journal-title":"Int. Technol. Lett."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"106790","DOI":"10.1109\/ACCESS.2021.3101188","article-title":"An End-to-End Framework for Machine Learning-Based Network Intrusion Detection System","volume":"9","author":"Bertoli","year":"2021","journal-title":"IEEE Access"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Mahbooba, B., Sahal, R., Alosaimi, W., and Serrano, M. (2021). Trust in intrusion detection systems: An investigation of performance analysis for machine learning and deep learning models. Complexity, 2021.","DOI":"10.1155\/2021\/5538896"},{"key":"ref_49","unstructured":"Yahalom, R., Steren, A., Nameri, Y., and Roytman, M. (2021, December 01). Small Versions of the Extracted Features Datasets for 9 Attacks on IP Camera and IoT Networks Generated by Mirskey et al., Mendeley Data. Available online: https:\/\/data.mendeley.com\/datasets\/zvsk3k9cf2\/1."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"82","DOI":"10.1016\/j.inffus.2019.12.012","article-title":"Explainable Artificial Intelligence (XAI): Concepts, taxonomies, opportunities, and challenges toward responsible AI","volume":"58","author":"Arrieta","year":"2020","journal-title":"Inf. Fusion"},{"key":"ref_51","unstructured":"Das, A., and Paul, R. (2020). Opportunities and challenges in explainable artificial intelligence (XAI): A survey. arXiv."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"52138","DOI":"10.1109\/ACCESS.2018.2870052","article-title":"Peeking inside the black-box: A survey on explainable artificial intelligence (XAI)","volume":"6","author":"Adadi","year":"2018","journal-title":"IEEE Access"},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"197","DOI":"10.1177\/1541931218621047","article-title":"Explaining explanation for \u201cexplainable AI\u201d","volume":"62","author":"Hoffman","year":"2018","journal-title":"Proc. Hum. Factors Ergon. Soc. Annu. Meet."}],"container-title":["Big Data and Cognitive Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-2289\/6\/4\/126\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:02:40Z","timestamp":1760144560000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-2289\/6\/4\/126"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,25]]},"references-count":53,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2022,12]]}},"alternative-id":["bdcc6040126"],"URL":"https:\/\/doi.org\/10.3390\/bdcc6040126","relation":{},"ISSN":["2504-2289"],"issn-type":[{"value":"2504-2289","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,10,25]]}}}