Search

The escalating complexity of malicious digital activities highlights the necessity for dependable and transparent intrusion detection systems (IDS) to preserve network integrity. Although machine learning frameworks like Decision Tree (DT), Random Forest (RF), k-Nearest Neighbors (K-NN), and XGBoost demonstrate exceptional capabilities in identifying malicious behavior, their inner mechanics grow increasingly opaque as structural complexity and predictive precision expand, creating challenges for high-stakes safety operations. Local Interpretable Model-agnostic Explanations (LIME) is frequently deployed to mitigate this issue; nevertheless, its dependency on Gaussian distributions when generating data variations often fails to capture the non-linear and disproportionate traits of frameworks like CIC-IDS-2018. To overcome these limitations, we introduce an adapted LIME variation strategy utilizing Weibull, Gamma, Beta, and Pareto distributions to more accurately represent the attributes of network telemetry. Our framework enhances the consistency of diverse machine learning systems optimized on CIC-IDS repositories, yielding more constructive and dependable rationales for predictive outputs. These proposed algorithmic adjustments yield a gain in explanatory fidelity of up to 78% relative to the standard normal distribution framework. Variations rooted in the Pareto distribution deliver the most optimal outcomes. Across all evaluated distributions, the Pareto framework consistently generated the peak explanation fidelity and consistency, notably for K-NN (R^2 = 0.9971, S = 0.9907) and DT (R^2 = 0.9267, S = 0.9797). This demonstrates that heavy-tailed distributions align effectively with actual network operational trends, minimizing the discrepancy in attribute significance justifications and rendering them more resilient.

Graph neural networks (GNNs) have been successfully deployed across numerous practical domains, yet the precise mechanisms underlying their operations remain largely opaque. In response to this lack of clarity and to encourage the deployment of reliable AI systems, a variety of GNN explanation tools have been developed. Nonetheless, current interpretation techniques frequently encounter severe bottlenecks, including: (1) explanations that are restricted to localized individual instances; (2) poor generalizability when applied to unfamiliar graph structures; (3) the risk of creating structurally invalid graphs; and (4) confinement to specific task domains (such as only node or only graph classification). To resolve these deficiencies, we introduce a novel interpretation framework, GAN-GNNExplainer, which integrates a generator to construct explanations alongside a discriminator to supervise the production stage, thereby enhancing output dependability. Although advantageous, GAN-GNNExplainer still exhibits limitations in producing highly faithful explanations and shows suboptimal performance when tested on empirical datasets. To rectify these weaknesses, we present ACGAN-GNNExplainer, an advanced iteration that enhances GAN-GNNExplainer by utilizing a more robust discriminator to continuously monitor the generation phase, which yields explanatory outputs that are both dependable and faithful. Comprehensive empirical evaluations conducted on both artificial and empirical graph datasets confirm that our proposed methodologies outperform conventional GNN explanation frameworks.

In recent years, considerable attention has been directed toward clarifying complex, opaque systems, commonly referred to as black-box models, including deep neural networks and random forests. So-called model-agnostic techniques generally approximate the outputs of these non-transparent systems using an interpretable architecture, ignoring the internal mechanisms of the primary black-box system itself. Consequently, it remains an important inquiry whether the straightforward training of transparent, white-box architectures ought to be favored over the post-hoc approximation of these opaque models. This study presents the findings of an empirical investigation comparing post-hoc explanatory methods against inherently interpretable architectures across multiple datasets, focusing on both rule-based and feature-based frameworks. The empirical outcomes indicate that directly trained transparent models frequently approximate black-box models with an accuracy that matches or exceeds that of post-hoc surrogate models, despite lacking direct access to the underlying black-box structure.

Machine learning-driven decision support tools ought to assist users in detecting prospective advantages and risks. Widespread model-independent explanation frameworks can pinpoint elements underpinning specific forecasts—addressing queries like "What factors affect sales?" or "Why did sales decline?"—yet fail to indicate the actionable steps an individual can or should take to achieve a more favorable result. Although counterfactual explanation methods target actionable interventions and occasionally account for feasibility, they generally overlook viability for real-time systems like interactive question-answering platforms. In this study, we bridge this divide by proposing a unique model-agnostic technique that details concrete, viable adjustments capable of altering the predictions of a sophisticated Black Box AI framework for a specific instance; furthermore, we evaluate its practical utility by evaluating its computational speed in real time alongside its capacity to discover executable modifications. The developed approach leverages the target instance to produce high-precision explanations, subsequently employing a secondary mechanism to identify achievable minimally-contrastive counterfactual explanations (AMCC) by restricting the exploration space exclusively to modifications that adhere to domain-specific restrictions. Utilizing a well-established dataset, we assessed the classification procedure to determine both the success rate and the computational duration necessary to pinpoint valid counterfactual alternatives. Within the context of a classifier maintaining 90% accuracy, our proposed algorithm successfully extracted AMCC explanations in 47% of instances (38 of 81), requiring an average generation time of 80 ms. These outcomes confirm the efficiency of the algorithm in rapidly generating AMCC explanations, establishing its appropriateness for real-time deployments. The AMCC approach improves the interpretability of obscure Black Box AI models, thereby assisting stakeholders in analyzing corrective techniques or evaluating prospective consequences.

Explainable artificial intelligence increasingly offers diverse ways to communicate how intelligent systems operate, yet explanation selection is still frequently driven by method availability or model compatibility rather than stakeholder need. This article develops a stakeholder-oriented taxonomy for determining which explanation type may be appropriate for whom, at which decision moment, and for what purpose. Explanation is treated as a multiform system capability encompassing different scopes, reasoning functions, presentation modes, interaction patterns, and quality requirements. The taxonomy distinguishes global explanations concerned with model-level behaviour from local explanations directed at individual predictions, while clarifying the roles and limitations of feature attribution, saliency, surrogate models, rule extraction, transparency, fidelity, stability, and completeness. It further differentiates counterfactual, contrastive, and causal explanations according to their contributions to alternative reasoning, actionability, contestability, recourse, and accountability. Example-based, case-based, prototype, rule-based, natural-language, interactive, dialogue-based, adaptive, and personalized explanations are positioned according to user expertise, cognitive accessibility, task demands, and interaction context. The proposed taxonomy connects explanation families with stakeholder roles, pre-decision, during-decision, and post-decision timing, explanation purpose, decision consequence, uncertainty, trust calibration, human oversight, and accountability requirements. Its central contribution is a structured selection logic that moves beyond technical method categories toward stakeholder–purpose–timing–risk alignment. The taxonomy can guide explanation design and evaluation but does not independently establish understanding, fairness, recourse, accountability, legal sufficiency, trustworthiness, or deployment readiness. Stakeholder-specific and decision-context-specific validation therefore remains necessary.

Explainable artificial intelligence has generated extensive technical and human-centered evaluation research, yet substantial uncertainty remains about what explanation evaluations actually demonstrate. This umbrella review synthesizes review-level evidence concerning the evaluation of fidelity, faithfulness, stability, robustness, comprehensibility, cognitive accessibility, decision usefulness, human trust, trust calibration, and reliance. Rather than reviewing explanation algorithms as methods, the article examines the constructs, metrics, study designs, and validity assumptions through which explanation quality has been assessed. The synthesis distinguishes technical correspondence with model behavior from human judgments of plausibility, understanding, usefulness, and satisfaction. It further separates human trust from system trustworthiness and behavioral reliance from beneficial decision support. Review-level evidence indicates that technical metrics are heterogeneous, terminology is inconsistently operationalized, and stable or plausible explanations are not necessarily faithful. Human-centered evaluations frequently rely on self-reported understanding, satisfaction, or trust, while objective comprehension, cognitive load, decision quality, appropriate reliance, overreliance, and underreliance receive less consistent assessment. Evidence linking technical explanation properties to downstream human and institutional outcomes remains limited, particularly across stakeholder groups, realistic decision contexts, repeated use, and changing system conditions. The umbrella synthesis therefore rejects single-metric interpretations of explanation quality and organizes evaluation as a multidimensional evidence problem involving technical validity, cognitive accessibility, decision consequences, calibrated trust, reliance behavior, accountability, and contestability. Its principal contribution is a consolidated evaluation agenda that clarifies what existing measures may support, what they do not establish, and which methodological connections require stronger user-centered, task-specific, longitudinal, and socio-technical validation.