Search

The escalating complexity of malicious digital activities highlights the necessity for dependable and transparent intrusion detection systems (IDS) to preserve network integrity. Although machine learning frameworks like Decision Tree (DT), Random Forest (RF), k-Nearest Neighbors (K-NN), and XGBoost demonstrate exceptional capabilities in identifying malicious behavior, their inner mechanics grow increasingly opaque as structural complexity and predictive precision expand, creating challenges for high-stakes safety operations. Local Interpretable Model-agnostic Explanations (LIME) is frequently deployed to mitigate this issue; nevertheless, its dependency on Gaussian distributions when generating data variations often fails to capture the non-linear and disproportionate traits of frameworks like CIC-IDS-2018. To overcome these limitations, we introduce an adapted LIME variation strategy utilizing Weibull, Gamma, Beta, and Pareto distributions to more accurately represent the attributes of network telemetry. Our framework enhances the consistency of diverse machine learning systems optimized on CIC-IDS repositories, yielding more constructive and dependable rationales for predictive outputs. These proposed algorithmic adjustments yield a gain in explanatory fidelity of up to 78% relative to the standard normal distribution framework. Variations rooted in the Pareto distribution deliver the most optimal outcomes. Across all evaluated distributions, the Pareto framework consistently generated the peak explanation fidelity and consistency, notably for K-NN (R^2 = 0.9971, S = 0.9907) and DT (R^2 = 0.9267, S = 0.9797). This demonstrates that heavy-tailed distributions align effectively with actual network operational trends, minimizing the discrepancy in attribute significance justifications and rendering them more resilient.

Explainable artificial intelligence has generated extensive technical and human-centered evaluation research, yet substantial uncertainty remains about what explanation evaluations actually demonstrate. This umbrella review synthesizes review-level evidence concerning the evaluation of fidelity, faithfulness, stability, robustness, comprehensibility, cognitive accessibility, decision usefulness, human trust, trust calibration, and reliance. Rather than reviewing explanation algorithms as methods, the article examines the constructs, metrics, study designs, and validity assumptions through which explanation quality has been assessed. The synthesis distinguishes technical correspondence with model behavior from human judgments of plausibility, understanding, usefulness, and satisfaction. It further separates human trust from system trustworthiness and behavioral reliance from beneficial decision support. Review-level evidence indicates that technical metrics are heterogeneous, terminology is inconsistently operationalized, and stable or plausible explanations are not necessarily faithful. Human-centered evaluations frequently rely on self-reported understanding, satisfaction, or trust, while objective comprehension, cognitive load, decision quality, appropriate reliance, overreliance, and underreliance receive less consistent assessment. Evidence linking technical explanation properties to downstream human and institutional outcomes remains limited, particularly across stakeholder groups, realistic decision contexts, repeated use, and changing system conditions. The umbrella synthesis therefore rejects single-metric interpretations of explanation quality and organizes evaluation as a multidimensional evidence problem involving technical validity, cognitive accessibility, decision consequences, calibrated trust, reliance behavior, accountability, and contestability. Its principal contribution is a consolidated evaluation agenda that clarifies what existing measures may support, what they do not establish, and which methodological connections require stronger user-centered, task-specific, longitudinal, and socio-technical validation.