Explainable AI for Forensic Analysis: A Comparative Study of SHAP and LIME in Intrusion Detection Models
Source abstract
Abstract
The lack of interpretability in AI-based intrusion detection systems poses a critical barrier to their adoption in forensic cybersecurity, which demands high levels of reliability and verifiable evidence. To address this challenge, the integration of explainable artificial intelligence (XAI) into forensic cybersecurity offers a powerful approach to enhancing transparency, trust, and legal defensibility in network intrusion detection. This study presents a comparative analysis of SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME) applied to Extreme Gradient Boosting (XGBoost) and Attentive Interpretable Tabular Learning (TabNet), using the UNSW-NB15 dataset. XGBoost achieved 97.8% validation accuracy and outperformed TabNet in explanation stability and global coherence. In addition to classification performance, we evaluate the fidelity, consistency, and forensic relevance of the explanations. The results confirm the complementary strengths of SHAP and LIME, supporting their combined use in building transparent, auditable, and trustworthy AI systems in digital forensic applications.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Anomaly Detection Techniques and Applications · Adversarial Robustness in Machine Learning · Explainable Artificial Intelligence (XAI)
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Escuela de Ingeniería Informática, Pontificia Universidad Católica de Valparaíso, Valparaíso 2362807, Chile
Knowledge Discovery, Fraunhofer-Institute of Intelligent Analysis and Information Systems (IAIS), 53757 Sankt Augustin, Germany
Lamarr Institute for Machine Learning and Artificial Intelligence, 44227 Dortmund, Germany
References (49)
Show source-provided references
1. Mohale, V.Z., and Obagbuwa, I.C. (2025). A systematic review on the integration of explainable artificial intelligence in intrusion detection systems to enhancing transparency and interpretability in cybersecurity. Front. Artif. Intell., 8.10.3389/frai.2025.1526221 ↗
2. A unified approach to interpreting model predictions
3. Ribeiro, M.T., Singh, S., and Guestrin, C. (2016, January 13–17). “Why should I trust you?” Explaining the predictions of any classifier. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA.10.1145/2939672.2939778 ↗
4. Siganos, M., Radoglou-Grammatikis, P., Kotsiuba, I., Markakis, E., Moscholios, I., Goudos, S., and Sarigiannidis, P. (2023, January 25–27). Explainable AI-based Intrusion Detection in the Internet of Things. Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES), Málaga, Spain.10.1145/3600160.3605162 ↗
5. Arreche, D., Martín, J., and Scavuzzo, T. (2024). An Explainable Artificial Intelligence Framework for Network Intrusion Detection Using SHAP and LIME. Appl. Sci., 14.10.3390/app14104170 ↗
6. Solanke, O., Adewumi, A., and Daramola, O. (2024). Explainable Artificial Intelligence for Digital Forensics: Enhancing Trust in Machine Learning-Based Decisions. Electronics, 13.
7. Kuk, S., Pauli, J., and Sattler, T. (2022). Interpretable Machine Learning for Intrusion Detection Systems Using SHAP and Rule-Based Models. Appl. Sci., 12.
8. (2025, May 07). Special Issue: Explainable Artificial Intelligence and Machine Learning Models. Available online: https://www.mdpi.com/journal/applsci/special_issues/NUTS41J5Z8.
9. Li, X., Wang, S., Zhang, Q., and Yang, Y. (2023). Explainable Artificial Intelligence for Intrusion Detection: A Survey and Case Studies Using SHAP and LIME. Appl. Sci., 13.
10. Paul, A., and Sanyal, S. (2022). Application of LIME and SHAP for Interpretable Deep Learning-Based Intrusion Detection Systems. Appl. Sci., 12.
11. Jamil, F., Ahmad, A., and Abbas, M. (2023). Legal and Ethical Implications of Using AI in Cybersecurity: A Forensic Perspective. Appl. Sci., 13.
12. Liang, J., Fan, T., and Zhang, Q. (2024). Social Network Representation Learning and Key Figure Mining Based on Social Entropy. Entropy, 26.
13. Yang, H., Wang, C., and Sun, J. (2023). Intrusion Detection for VANETs Based on Evidence Theory Using Vehicle Flow Rate and Speed Features. Sensors, 23.
14. Lima, C., Fernandes, R., and Silva, R. (2024). Explainable AI and Deep Learning Challenges in Digital Forensics. Computers, 14.
15. (2025, May 07). ISO/IEC 23894:2023 Artificial Intelligence—Guidance on Risk Management. International Organization for Standardization. Available online: https://www.iso.org/standard/80940.html.
16. Author, A., and Author, B. (2024). XAI-CF: An Explainable AI Framework for Digital Forensics. arXiv.
17. Towards a Unified XAI-based Framework for Digital Forensic Investigations
18. Moustafa, N., and Slay, J. (2015, January 10–12). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia.10.1109/MilCIS.2015.7348942 ↗
19. UNSW-NB15 dataset: Modernized network traffic benchmark for intrusion detection systems
20. Feature selection techniques for improving machine learning models in cybersecurity
21. Robust feature selection methods for modern ML systems: A comparative study
22. Machine learning approaches for anomaly detection in network security
23. Husain, A., Salem, A., Jim, C., and Dimitoglou, G. (2019, January 10–12). Development of an Efficient Network Intrusion Detection Model Using Extreme Gradient Boosting (XGBoost) on the UNSW-NB15 Dataset. Proceedings of the 2019 IEEE International Symposium on Signal Processing and Information Technology (ISSPIT), Ajman, United Arab Emirates.10.1109/ISSPIT47144.2019.9001867 ↗
24. Arik, S.O., and Pfister, T. (2019). TabNet: Attentive Interpretable Tabular Learning. arXiv.
25. Explainable AI for tree-based models with SHAP and LIME: A comprehensive review
26. Model-agnostic interpretability techniques: A survey on LIME and SHAP applications
27. Explainable AI: Interpretable models and beyond
28. Interpretable machine learning: Advances in LIME for high-dimensional data
29. Scalable LIME: Enhancing interpretability for massive datasets
30. Monotonic Solutions to General Cooperative Games10.2307/1911238 ↗
31. Molnar, C. (2019). Interpretable Machine Learning, Lulu.com.
32. Many Shapley value methods: A unified perspective and comparison
33. Molnar, C. (2022). Interpretable Machine Learning: A Guide for Making Black Box Models Explainable, Leanpub.
34. SHAP explanations in financial AI: A review of applications and challenges
35. AI explainability in healthcare: Integrating SHAP for enhanced trust and usability
36. AI explainability: Legal requirements and SHAP’s role in meeting them
37. SHAP compliance in regulatory AI systems: A case study
38. A survey of methods for explaining black box models10.1145/3236009 ↗
39. Arras, L., Montavon, G., Müller, K.R., and Samek, W. (2016, January 5–10). Faithful visualization of neural network predictions for time series data. Proceedings of the Workshop on Interpretable Machine Learning in Complex Systems (NIPS), Barcelona, Spain.
40. Slack, D., Hilgard, S., Jia, E., Singh, S., and Sohoni, H.L. (2020, January 7–9). Fooling LIME and SHAP: Adversarial attacks on post hoc explanation methods. Proceedings of the 2020 AAAI/ACM Conference on AI, Ethics, and Society, New York, NY, USA.10.1145/3375627.3375830 ↗
41. Carvalho, D., Pereira, E., and Cardoso, J. (2019). Machine learning interpretability: A survey on methods and metrics. Electronics, 8.10.3390/electronics8080832 ↗
42. Tasnim, N., Mamun, S.M.A., Islam, M.S., Kaiser, M.S.I., and Mahmud, M.M.H. (2023). Explainable Mortality Prediction Model for Congestive Heart Failure with Nature-Based Feature Selection Method. Appl. Sci., 13.10.3390/app13106138 ↗
43. Analyzing UNSW-NB15 for Intrusion Detection in Modern Networks
44. Awotunde, J.B., Folorunso, S.O., Imoize, A.L., Odunuga, J.O., Lee, C.C., Li, C.T., and Do, D.T. (2023). An Ensemble Tree-Based Model for Intrusion Detection in Industrial Internet of Things Networks. Appl. Sci., 13.10.3390/app13042479 ↗
45. Evaluation of machine learning models using data splits: A practical approach
46. Benchmarking datasets and methods for cybersecurity applications: An overview
47. Why a right to explanation of automated decision-making does not exist in the general data protection regulation10.1093/idpl/ipx005 ↗
48. Hancox-Li, K., and Schoenholz, S.R. (2020). Robustness and stability of interpretability methods. arXiv.
49. Terziyan, D.S., and Yampolskiy, R.V. (2020, January 10–13). Forensic explainable artificial intelligence: A roadmap. Proceedings of the 2020 IEEE International Conference on Big Data (Big Data), Los Angeles, CA, USA.