# Explainable AI for Comparative Analysis of Intrusion Detection Models

arXiv: https://arxiv.org/abs/2406.09684 · HTML: https://mlsanity.com/paper/2406.09684/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 21 references that are in the map.
- First posted on arXiv 14 Jun 2024.

## Builds on (most cited first, 8 of 8)

- [Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localization](https://mlsanity.com/paper/1610.02391/) (2016)
- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Visualizing and Understanding Convolutional Networks](https://mlsanity.com/paper/1311.2901/) (2013)
- [Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI](https://mlsanity.com/paper/1910.10045/) (2019)
- [A Survey Of Methods For Explaining Black Box Models](https://mlsanity.com/paper/1802.01933/) (2018)
- [Exploring Adversarial Attacks on Neural Networks: An Explainable Approach](https://mlsanity.com/paper/2303.06032/) (2023)
- [NoiseCAM: Explainable AI for the Boundary Between Noise and Adversarial Attacks](https://mlsanity.com/paper/2303.06151/) (2023)

## Built on by (most cited first, 4 of 4)

- [XAI-based Feature Selection for Improved Network Intrusion Detection Systems](https://mlsanity.com/paper/2410.10050/) (2024)
- [CO-DEFEND: Continuous Decentralized Federated Learning for Secure DoH-Based Threat Detection](https://mlsanity.com/paper/2504.01882/) (2025)
- [Explainable Machine Learning for Cyberattack Identification from Traffic Flows](https://mlsanity.com/paper/2505.01488/) (2025)
- [Machine Learning for Cyber-Attack Identification from Traffic Flows](https://mlsanity.com/paper/2505.01489/) (2025)

## Abstract (arXiv)

Explainable Artificial Intelligence (XAI) has become a widely discussed topic, the related technologies facilitate better understanding of conventional black-box models like Random Forest, Neural Networks and etc. However, domain-specific applications of XAI are still insufficient. To fill this gap, this research analyzes various machine learning models to the tasks of binary and multi-class classification for intrusion detection from network traffic on the same dataset using occlusion sensitivity. The models evaluated include Linear Regression, Logistic Regression, Linear Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Random Forest, Decision Trees, and Multi-Layer Perceptrons (MLP). We trained all models to the accuracy of 90% on the UNSW-NB15 Dataset. We found that most classifiers leverage only less than three critical features to achieve such accuracies, indicating that effective feature engineering could actually be far more important for intrusion detection than applying complicated models. We also discover that Random Forest provides the best performance in terms of accuracy, time efficiency and robustness. Data and code available at https://github.com/pcwhy/XML-IntrusionDetection.git