# Using Kernel SHAP XAI Method to optimize the Network Anomaly Detection Model

arXiv: https://arxiv.org/abs/2308.00074 · HTML: https://mlsanity.com/paper/2308.00074/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 39 references that are in the map.
- First posted on arXiv 31 Jul 2023.

## Builds on (most cited first, 8 of 8)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI](https://mlsanity.com/paper/1910.10045/) (2019)
- [A Survey Of Methods For Explaining Black Box Models](https://mlsanity.com/paper/1802.01933/) (2018)
- [Explaining Anomalies Detected by Autoencoders Using SHAP](https://mlsanity.com/paper/1903.02407/) (2019)
- [Contextual Outlier Interpretation](https://mlsanity.com/paper/1711.10589/) (2017)
- [Shapley Values of Reconstruction Errors of PCA for Explaining Anomaly Detection](https://mlsanity.com/paper/1909.03495/) (2019)
- [Utilizing XAI technique to improve autoencoder based model for computer network anomaly detection with shapley additive explanation(SHAP)](https://mlsanity.com/paper/2112.08442/) (2021)
- [Instance-Level Explanations for Fraud Detection: A Case Study](https://mlsanity.com/paper/1806.07129/) (2018)

## Built on by (most cited first, 10 of 10)

- [Untargeted White-box Adversarial Attack with Heuristic Defence Methods in Real-time Deep Learning based Network Intrusion Detection System](https://mlsanity.com/paper/2310.03334/) (2023)
- [Black-box Adversarial Transferability: An Empirical Study in Cybersecurity Perspective](https://mlsanity.com/paper/2404.10796/) (2024)
- [Differential Privacy for Anomaly Detection: Analyzing the Trade-off Between Privacy and Explainability](https://mlsanity.com/paper/2404.06144/) (2024)
- [An Approach To Enhance IoT Security In 6G Networks Through Explainable AI](https://mlsanity.com/paper/2410.05310/) (2024)
- [On Using the Shapley Value for Anomaly Localization: A Statistical Investigation](https://mlsanity.com/paper/2507.21023/) (2025)
- [FairSHAP: Preprocessing for Fairness Through Attribution-Based Data Augmentation](https://mlsanity.com/paper/2505.11111/) (2025)
- [Beyond Technocratic XAI: The Who, What & How in Explanation Design](https://mlsanity.com/paper/2508.09231/) (2025)
- [An Explainable Failure Prediction Framework for Neural Networks in Radio Access Networks](https://mlsanity.com/paper/2602.13231/) (2026)
- [Statistical Analysis of using the Shapley Value for Sensor Anomaly Localization with Accurate Classifiers](https://mlsanity.com/paper/2606.00867/) (2026)
- [A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic](https://mlsanity.com/paper/2607.17105/) (2026)

## Abstract (arXiv)

Anomaly detection and its explanation is important in many research areas such as intrusion detection, fraud detection, unknown attack detection in network traffic and logs. It is challenging to identify the cause or explanation of why one instance is an anomaly? and the other is not due to its unbounded and lack of supervisory nature. The answer to this question is possible with the emerging technique of explainable artificial intelligence (XAI). XAI provides tools and techniques to interpret and explain the output and working of complex models such as Deep Learning (DL). This paper aims to detect and explain network anomalies with XAI, kernelSHAP method. The same approach is used to improve the network anomaly detection model in terms of accuracy, recall, precision and f score. The experiment is conduced with the latest CICIDS2017 dataset. Two models are created (Model_1 and OPT_Model) and compared. The overall accuracy and F score of OPT_Model (when trained in unsupervised way) are 0.90 and 0.76, respectively.