Comparative evaluation demonstrates explanation discrepancies despite high detection performance across cybersecurity datasets, highlighting the need for explanation-reliability audits.
Key Points
To develop and evaluate a comprehensive quantitative framework for auditing the reliability and stability of Explainable Artificial Intelligence (XAI) methods in machine-learning-based intrusion detection systems.
Assessed XGBoost, Random Forest, and Logistic Regression models on untouched test sets of the UNSW-NB15 and IoT-ToN network security benchmark datasets.
Audited explanation reliability using SHAP attributions, permutation importance ranking agreement, retraining stability, sufficiency and comprehensiveness retraining tests, and spurious-feature injection.
On UNSW-NB15, Random Forest and XGBoost achieved ROC AUCs of 0.9862 and 0.9858 (PR AUC: 0.9934 vs 0.9932; F1: 0.9231 vs 0.9217), outperforming Logistic Regression (ROC AUC: 0.9695, PR AUC: 0.9774, F1: 0.9037).
On IoT-ToN, XGBoost and Random Forest attained ROC AUC values of 0.9994 (F1: 0.9867 and 0.9879), while Logistic Regression degraded to an ROC AUC of 0.8502 (F1: 0.6081).
High predictive accuracy did not guarantee explanation reliability; Logistic Regression yielded the most stable explanations despite poor detection, whereas XGBoost and Random Forest provided the optimal explanation-accuracy balance across benchmarks.