{"id":"https://openalex.org/W7203587039","doi":"https://doi.org/10.5281/zenodo.21964554","title":"Explainable AI for Intrusion Detection on Live Multi-Service Honeypot Telemetry","display_name":"Explainable AI for Intrusion Detection on Live Multi-Service Honeypot Telemetry","publication_year":2026,"publication_date":"2026-08-16","ids":{"openalex":"https://openalex.org/W7203587039","doi":"https://doi.org/10.5281/zenodo.21964554"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.21964554","doi":"https://doi.org/10.5281/zenodo.21964554","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.21964554","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},"volume":null,"type":"dataset","is_traditional":false,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.21964554","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133484551","display_name":"Sridhar Govardhan","orcid":"https://orcid.org/0000-0002-2099-9283","observed_orcids":["https://orcid.org/0000-0002-2099-9283"]},"institutions":[{"id":"https://openalex.org/I83737708","display_name":"REVA University","ror":"https://ror.org/03gtcxd54","country_code":"IN","type":"education","lineage":["https://openalex.org/I83737708"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Govardhan, Sridhar","raw_affiliation_strings":["REVA University"],"raw_orcid":"https://orcid.org/0000-0002-2099-9283","affiliations":[{"raw_affiliation_string":"REVA University","institution_ids":["https://openalex.org/I83737708"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5133484551"],"corresponding_institution_ids":["https://openalex.org/I83737708"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.875,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.875,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.10329999774694443,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.007300000172108412,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/explainable-ai","display_name":"explainable AI","score":0.949999988079071},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.8949999809265137},{"id":"https://openalex.org/keywords/explanation-faithfulness","display_name":"explanation fidelity","score":0.6110000014305115},{"id":"https://openalex.org/keywords/feature-importance","display_name":"feature importance","score":0.31700000166893005},{"id":"https://openalex.org/keywords/adversarial-perturbations","display_name":"adversarial perturbations","score":0.3400000035762787},{"id":"https://openalex.org/keywords/network-security-monitoring","display_name":"network security monitoring","score":0.39399999380111694},{"id":"https://openalex.org/keywords/multilayer-perceptron","display_name":"multilayer perceptron","score":0.3970000147819519},{"id":"https://openalex.org/keywords/transformer","display_name":"transformer models","score":0.34700000286102295},{"id":"https://openalex.org/keywords/feature-ablation","display_name":"feature ablation","score":0.5059999823570251}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6315000057220459},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6240000128746033},{"id":"https://openalex.org/C183121708","wikidata":"https://www.wikidata.org/wiki/Q209867","display_name":"Telemetry","level":2,"score":0.5561000108718872},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.5475999712944031},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.5464000105857849},{"id":"https://openalex.org/C2780551164","wikidata":"https://www.wikidata.org/wiki/Q2306599","display_name":"Column (typography)","level":3,"score":0.4700999855995178},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.4131999909877777},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3953999876976013},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3467999994754791},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.32339999079704285},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2883000075817108},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.26489999890327454}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.5281/zenodo.21964554","doi":"https://doi.org/10.5281/zenodo.21964554","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.21964554","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},{"id":"doi:10.5281/zenodo.21964555","doi":"https://doi.org/10.5281/zenodo.21964555","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.21964555","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},{"id":"doi:10.5281/zenodo.22727709","doi":"https://doi.org/10.5281/zenodo.22727709","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22727709","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},{"id":"doi:10.5281/zenodo.22987525","doi":"https://doi.org/10.5281/zenodo.22987525","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22987525","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"}],"best_oa_location":{"id":"doi:10.5281/zenodo.21964554","doi":"https://doi.org/10.5281/zenodo.21964554","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.21964554","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7204105140","https://openalex.org/W7220698015","https://openalex.org/W7208736023","https://openalex.org/W7171044477","https://openalex.org/W7201837676","https://openalex.org/W7160537822","https://openalex.org/W7127171925","https://openalex.org/W7203771799","https://openalex.org/W6885177601","https://openalex.org/W7223410229"],"abstract_inverted_index":{"#":[0,302,310,322,333,344,351,359,367,378,387,397,405,413,420,427,436,442,448,458,468,476,483,489,495],"Are":[1],"Explanations":[2,239],"Faithful":[3,240],"Under":[4,241],"Fire?":[5,242],"Evaluating":[6,243],"XAI":[7,244],"Reliability":[8,245],"on":[9,193,246,264,291,541,690,845,854,1217,1458],"Live":[10,247],"Honeypot":[11,248],"Intrusion-Detection":[12,249],"Telemetry":[13],"##":[14,52,226,297,502,1426],"Supplementary":[15],"Data":[16],"and":[17,37,279,348,464,479,497,1402,1514],"Code":[18],"\u2014":[19,283,692,747,850,966,997,1019,1172,1220,1431,1505],"Version":[20,56],"3.0":[21,48,59],"[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22727709.svg)](https://doi.org/10.5281/zenodo.22727709)":[22],">":[23],"**Authors:**":[24],"Sridhar":[25],"G,":[26],"J":[27],"B":[28],"Simha,":[29],"Rashmi":[30],"Agarwal>":[31],"**Affiliation:**":[32],"School":[33],"of":[34,259,733,738,756,847,1449],"Computer":[35],"Science":[36],"Application":[38],"/":[39],"RACE,":[40],"REVA":[41],"University,":[42],"Bengaluru,":[43],"India>":[44],"**Contact:**":[45],"sridhargovardhan@race.reva.edu.in>":[46],"**Version:**":[47],"(September":[49],"2026)":[50],"---":[51,225,296,501,1425],"What":[53],"Changed":[54],"from":[55,694,1202],"2.0":[57],"to":[58,928,1470],"|":[60,62,64,69,72,81,88,102,105,116,120,132,135,143,146,155,160,170,174,181,187,198,201,206,209,215,218,224,546,548,550,554,556,559,562,565,570,572,574,576,578,580,582,586,588,590,592,594,596,598,602,604,606,608,610,612,614,618,620,622,624,626,628,630,634,636,638,640,642,644,646,650,652,654,656,658,660,662,664,767,769,774,781,785,791,795,801,805,811,815,821,825,831,835,839,865,867,870,874,878,880,882,887,889,891,896,898,900,905,907,909,912,1030,1032,1036,1041,1044,1048,1051,1055,1058,1062,1065,1067,1072,1075,1077,1079,1081,1085,1088,1091,1094,1099,1102,1105,1108,1113,1116,1119,1122,1127,1130,1133,1136,1142,1145,1148,1151,1154,1228,1230,1232,1235,1238,1243,1245,1247,1249,1253,1255,1257,1259,1263,1265,1267,1269,1273,1275,1277,1279,1283,1285,1287,1289,1293,1295,1297,1299,1301,1308,1310,1313,1316,1319,1324,1326,1328,1330,1334,1336,1338,1340,1344,1346,1348,1350,1354,1356,1358,1360,1364,1366,1368,1370,1374,1376,1378,1380,1382],"Change":[61],"v2.0":[63],"v3.0":[65],"||---|---|---||":[66,779,1039],"**Primary":[67],"faithfulness**":[68],"Retraining-based":[70,421,437],"AUDAC":[71,75,422,463,552,775,1233,1498],"**Frozen-model**":[73],"masking-based":[74,1497],"(no":[76],"retraining)":[77],"||":[78,99,112,130,140,153,167,179,196,204,212,584,600,616,632,648,789,799,809,819,829,885,894,903,1046,1053,1060,1097,1111,1125,1139,1251,1261,1271,1281,1291,1332,1342,1352,1362,1372],"**AUDAC":[79],"values**":[80],"RF":[82,133,156,569,702,715,780,877,1040,1076,1242,1333],"0.679,":[83],"XGB":[84,91,124,1078],"0.662,":[85],"LGB":[86,93,126,1080],"0.688":[87],"**RF":[89],"0.352,":[90],"0.348,":[92],"0.346,":[94],"MLP":[95,128,328,349,374,617,711,724,810,904,1061,1082,1272,1363],"0.442,":[96],"LSTM":[97,633,820,1282,1353],"0.463**":[98],"**Flip":[100],"rate**":[101],"Malicious":[103],"only":[104,134,145,157,675,1182],"**Both":[106],"malicious":[107,734,757,1513],"AND":[108],"benign**":[109],"(trees:":[110],"100%/0%)":[111],"**Per-instance":[113],"SHAP-LIME":[114,346,859,1239],"\u03c1**":[115],"Negative":[117,182,1155],"(\u22120.18,":[118],"buggy)":[119],"**Positive**":[121],"(RF":[122,454],"0.72,":[123],"0.43,":[125],"0.52,":[127],"0.58)":[129],"**LOSO**":[131],"**All":[136,161],"4":[137,392,408,965,1021],"sklearn":[138,1022],"models**":[139,163],"**Feature":[141],"ablation**":[142],"dst_port_id":[144,452,974,1084,1166],"**4":[147],"features**":[148],"(dst_port_id,":[149],"src_port_class,":[150],"hour_of_day,":[151],"ip_reputation_score)":[152],"**Multi-seed**":[154],"(3":[158],"seeds)":[159,195],"6":[162,207,469,1450],"\u00d7":[164,318,340,1452],"3":[165,319,341,1453],"seeds":[166,849],"**Service":[168,970],"inventory**":[169],"10":[171,981],"services":[172,985,1025],"listed":[173],"**2,309":[175],"unique":[176,401,973],"ports**":[177],"documented":[178],"**Transformer**":[180],"control":[183],"(F1":[184,190],"=":[185,191,668,673,679,686,843,925,1157,1464,1500],"55.9%)":[186],"**Convergence":[188],"failure**":[189],"0.00":[192,844],"2/3":[194],"**Labels**":[197],"\"True":[199],"labels\"":[200],"**\"Operational":[202],"annotations\"**":[203],"**Scripts**":[205],"scripts":[208],"**10":[210],"scripts**":[211],"**Result":[213],"files**":[214],"2":[216,222,1001],"CSVs":[217,220],"**7":[219],"+":[221,327,381],"TXT**":[223],"Overview":[227],"This":[228,533],"repository":[229],"contains":[230],"the":[231,236,287,292,537,542,750,947,978,1187,1213,1397,1441,1456,1459,1479],"complete":[232],"reproducibility":[233],"package":[234],"for":[235,370,390,462,1169,1389,1392,1396,1444,1473,1476,1482,1490,1493,1511],"manuscript":[237],"*\"Are":[238],"Telemetry.\"*":[250],"The":[251,1437],"central":[252,1438],"contribution":[253],"is":[254,271,1163,1215],"a":[255,276,929,1205,1422,1467],"**frozen-model":[256],"faithfulness":[257],"evaluation**":[258],"model-agnostic":[260],"explanations":[261],"(SHAP,":[262],"LIME)":[263],"live":[265],"adversarial":[266,1414],"honeypot":[267,984],"traffic.":[268],"Each":[269],"model":[270,289,539,1214,1457],"trained":[272,288,514,538],"once,":[273],"saved":[274,517],"as":[275,518,1204,1421],"frozen":[277,314,519,1468,1480],"checkpoint,":[278],"evaluated":[280],"without":[281],"retraining":[282,691],"directly":[284,534],"measuring":[285],"whether":[286,536],"relies":[290],"features":[293,525,543,744,752,1219,1388],"SHAP":[294,329,524,544,743,1487],"identified.":[295,545],"Repository":[298],"Structure":[299],"```.\u251c\u2500\u2500":[300],"README.md\u2502\u251c\u2500\u2500":[301],"\u2500\u2500":[303,352,414,443,490],"Primary":[304,334,507,1432],"Analysis:":[305,416,508,1198],"Frozen-Model":[306,509],"Faithfulness":[307,428,510,1200,1433],"\u2500\u2500\u251c\u2500\u2500":[308,357,418,446],"frozen_model_faithfulness.py":[309],"Trains,":[311],"saves,":[312],"evaluates":[313],"models":[315,317,339,393,1023,1171,1451],"(6":[316,338,439,499],"seeds)\u251c\u2500\u2500":[320,342],"frozen_fixes.py":[321],"Corrects":[323],"LIME":[324,930,934],"name-matching":[325],"bug":[326],"Pipeline":[330],"error\u251c\u2500\u2500":[331],"frozen_faithfulness.csv":[332],"results:":[335],"18":[336],"rows":[337],"frozen_fixes_results.txt":[343],"Corrected":[345,484,954],"\u03c1":[347,564,567,869,873,924,1240],"AUDAC\u2502\u251c\u2500\u2500":[350],"Service":[353,962],"Generalisation":[354,963],"(Phase":[355,964],"4)":[356],"phase4_generalisation.py":[358],"LOSO":[360,368],"all":[361,391,1020,1170,1177,1483],"models,":[362,440],"multi-feature":[363],"ablation,":[364],"CIs\u251c\u2500\u2500":[365],"loso_all_models.csv":[366],"F1":[369,389,549,770,842,1034,1158,1168,1231,1312,1318],"RF,":[371],"XGBoost,":[372],"LightGBM,":[373],"(48":[375,394],"rows)\u251c\u2500\u2500":[376,385,395],"multi_feature_ablation.csv":[377],"4-feature":[379],"ablation":[380,453,1069],"combined":[382],"removal":[383,1210],"(20":[384],"per_service_all_models.csv":[386],"Per-service":[388,449],"service_inventory.csv":[396],"Complete":[398],"inventory:":[399],"2,309":[400,972],"destination":[402],"ports\u251c\u2500\u2500":[403],"phase4_results.txt":[404],"Full":[406],"Phase":[407],"output":[409],"with":[410,527,935,1004,1026],"bootstrap":[411],"CIs\u2502\u251c\u2500\u2500":[412],"Secondary":[415,1197],"Retraining-Based":[417,1199],"run_faithfulness_retraining.py":[419],"(secondary":[423],"robustness":[424,1206],"analysis)\u251c\u2500\u2500":[425],"xai_faithfulness_metrics.py":[426],"metrics":[429],"library":[430],"(AUDAC,":[431],"flip":[432,465,731,1509],"rate,":[433],"sparsity)\u251c\u2500\u2500":[434],"faithfulness_retraining_results.csv":[435],"results":[438],"seed=42)\u2502\u251c\u2500\u2500":[441],"Supporting":[444],"Scripts":[445],"per_service_evaluation.py":[447],"F1,":[450],"LOSO,":[451],"only,":[455],"v2)\u251c\u2500\u2500":[456],"bootstrap_ci.py":[457],"Bootstrap":[459],"95%":[460,697],"CIs":[461,698],"rate\u251c\u2500\u2500":[466],"reviewer_experiments.py":[467],"reviewer-response":[470],"analyses":[471],"in":[472,863,915,919,955,968,1192,1435],"one":[473,680],"pass\u251c\u2500\u2500":[474],"benchmark_diagnostics.py":[475],"Leakage":[477],"audit":[478],"de-duplication":[480],"analysis\u251c\u2500\u2500":[481],"unsw_corrected_split_rerun.py":[482],"UNSW-NB15":[485,496,1311,1314],"official":[486],"split":[487],"re-run\u2502\u251c\u2500\u2500":[488],"Benchmark":[491,1304],"Results":[492,504],"\u2500\u2500\u2514\u2500\u2500":[493],"verified_benchmark_results.csv":[494],"CIC-IDS2017":[498,1317,1320,1393],"models)```":[500],"Key":[503],"###":[505,759,857,960,1195,1302,1429],"1.":[506],"(Table":[511,1306],"9)":[512],"Models":[513],"once":[515],"\u2192":[516,522,530],"checkpoints":[520],"(.pkl/.keras)":[521],"top-k":[523],"masked":[526,746],"training-set":[528],"medians":[529],"**no":[531,1506],"retraining**.":[532],"measures":[535],"depends":[540],"Model":[547,768,866,1031,1229,1309],"Frozen":[551],"\u2193":[553,1234],"Mono.":[555],"Flip":[557,560,1236],"Mal":[558],"Ben":[561],"Global":[563,868],"Per-inst":[566],"||---|---|---|---|---|---|---|---||":[568],"88.6%":[571],"**0.352**":[573],"Strict":[575,667],"100%":[577,593,609,732,1248,1268],"0%":[579,595,611,657,737],"0.87":[581,629,879,906,1280],"0.72":[583,881],"XGBoost":[585,705,718,790,886,1047,1252,1323],"88.2%":[587],"**0.348**":[589],"Essential":[591,607,672],"0.93":[597,888,1250,1290],"0.43":[599,890],"LightGBM":[601,708,721,800,895,1054,1262,1343],"88.1%":[603],"**0.346**":[605],"0.85":[613,897],"0.52":[615,899],"87.7%":[619],"**0.442**":[621],"Mostly":[623,639,678],"98.8%":[625],"2.2%":[627],"0.58":[631,908],"83.4%":[635],"**0.463**":[637],"87.0%":[641],"13.6%":[643],"N/A":[645,647,655,659,661,663],"Transformer":[649,830,840,1292,1373],"67.0%":[651],"0.670":[653],"**Monotonicity":[665],"tiers:**":[666],"no":[669,1173],"violations":[670,674],"(k=0\u201310);":[671],"near":[676],"chance;":[677],"real":[681],"violation,":[682],"overall":[683],"downward;":[684],"Anti":[685],"accuracy":[687],"rises":[688],"(Transformer":[689],"excluded":[693],"primary).":[695],"**Bootstrap":[696],"(frozen,":[699],"seed=42):**-":[700],"AUDAC:":[701],"[0.338,":[703],"0.366],":[704],"[0.332,":[706],"0.365],":[707],"[0.330,":[709],"0.362],":[710],"[0.425,":[712],"0.460]-":[713],"Flip-rate:":[714],"[1.000,":[716,719,722],"1.000],":[717,720,723],"[0.970,":[725],"1.000]":[726],"**Key":[727],"finding:**":[728],"Tree":[729],"ensembles":[730],"predictions":[735,740],"but":[736,1416],"benign":[739,1515],"when":[741,1160],"top":[742],"are":[745,753],"confirming":[748,1185],"that":[749,1161,1186],"identified":[751],"specifically":[754],"diagnostic":[755],"behaviour.":[758],"2.":[760],"Multi-Seed":[761],"Variance":[762],"(seeds":[763],"42,":[764],"7,":[765],"2024)":[766],"(mean":[771,776],"\u00b1":[772,777,783,787,793,797,803,807,813,817,823,827,833,837],"SD)":[773,778],"0.891":[782],"0.005":[784],"0.341":[786],"0.018":[788,828],"0.884":[792],"0.003":[794],"0.428":[796],"0.086":[798],"0.888":[802],"0.006":[804],"0.378":[806],"0.027":[808],"0.881":[812],"0.004":[814],"0.677":[816],"0.024":[818],"0.851":[822],"0.014":[824],"0.461":[826],"0.223":[832,836],"0.387":[834,838],"achieves":[841],"two":[846],"three":[848],"catastrophic":[851],"convergence":[852],"instability":[853],"tabular":[855],"data.":[856],"3.":[858],"Cross-Method":[860],"Consistency":[861],"(corrected":[862],"v3)":[864,969,1436],"Per-instance":[871,917],"median":[872],"IQR":[875],"||---|---|---|---||":[876],"[0.63,":[883],"0.82]":[884],"[0.30,":[892],"0.59]":[893],"[0.38,":[901],"0.68]":[902,911],"[0.48,":[910],"**Bug":[913],"fix":[914],"v3:**":[916],"values":[918,975,1488],"v2":[920,1203],"were":[921],"negative":[922],"(median":[923],"\u22120.18)":[926],"due":[927],"feature-name":[931],"matching":[932],"error.":[933],"`discretize_continuous=True`":[936],"returns":[937],"names":[938,950],"like":[939],"`\"payload_length_bytes":[940],"<=":[941],"245.50\"`":[942],"which":[943],"did":[944],"not":[945,1418],"match":[946],"original":[948],"feature":[949,1162,1385],"during":[951,977],"rank-correlation":[952],"computation.":[953],"`frozen_fixes.py`":[956],"using":[957],"substring":[958],"matching.":[959],"4.":[961],"new":[967],"inventory:**":[971],"observed":[976],"21-day":[979],"deployment:-":[980],"deliberately":[982],"deployed":[983],"(ports":[986],"21,":[987],"22,":[988],"25,":[989],"53,":[990],"80,":[991],"443,":[992],"3306,":[993],"3389,":[994],"5900,":[995],"6379)":[996],"651\u2013744":[998],"sessions":[999,1016],"each-":[1000],"additional":[1002],"ports":[1003,1014],"substantial":[1005],"traffic":[1006],"(8080":[1007],"HTTP-alt,":[1008],"8443":[1009],"HTTPS-alt)-":[1010],"~2,297":[1011],"ephemeral":[1012],"scanning/probing":[1013],"(1\u20132":[1015],"each)":[1017],"**LOSO":[1018],"(12":[1024],"\u226510":[1027],"test":[1028],"samples):**":[1029],"Mean":[1033],"Drop":[1035],"Services":[1037],"Improved":[1038],"\u22120.10":[1042],"pp":[1043,1050,1057,1064,1087,1090,1093,1096,1101,1104,1107,1110,1115,1118,1121,1124,1129,1132,1135,1138],"4/12":[1045,1052],"+0.54":[1049],"\u22120.07":[1056],"6/12":[1059],"\u22120.43":[1063],"7/12":[1066],"**Multi-feature":[1068],"(all":[1070],"models):**":[1071],"Feature":[1073],"Removed":[1074],"||---|---|---|---|---||":[1083,1241,1322],"\u22120.35":[1086],"\u22120.51":[1089],"\u22120.38":[1092],"\u22121.42":[1095],"src_port_class":[1098],"+0.61":[1100],"+0.89":[1103],"+0.14":[1106],"+0.63":[1109],"hour_of_day":[1112],"+0.81":[1114],"+1.51":[1117],"+0.38":[1120],"+0.96":[1123],"ip_reputation_score":[1126],"\u22120.74":[1128],"+0.80":[1131],"+0.25":[1134],"\u22120.46":[1137],"**ALL":[1140],"FOUR**":[1141],"**+2.80":[1143],"pp**":[1144,1147,1150,1153],"**+3.36":[1146],"**+2.68":[1149],"**+5.43":[1152],"drop":[1156],"*improves*":[1159],"removed.":[1164],"Removing":[1165,1176],"improves":[1167],"shortcut":[1174],"learning.":[1175],"four":[1178],"service-related":[1179],"proxies":[1180],"costs":[1181],"2.7\u20135.4":[1183],"pp,":[1184],"core":[1188],"detection":[1189],"signal":[1190],"resides":[1191],"behavioural":[1193],"features.":[1194],"5.":[1196],"Retained":[1201],"check.":[1207],"For":[1208,1447],"each":[1209,1448],"step":[1211],"k,":[1212],"retrained":[1216],"remaining":[1218],"allowing":[1221],"adaptation,":[1222],"producing":[1223],"higher":[1224],"(more":[1225],"conservative)":[1226],"AUDAC.":[1227],"%":[1237],"88.59%":[1244],"0.634":[1246],"88.27%":[1254],"0.617":[1256],"98.2%":[1258],"0.89":[1260],"88.17%":[1264],"0.633":[1266],"0.86":[1270],"87.01%":[1274],"0.676":[1276],"99.6%":[1278],"83.15%":[1284],"0.630":[1286],"12.8%":[1288],"59.16%":[1294],"0.603":[1296],"15.0%":[1298],"0.70":[1300],"6.":[1303],"Comparison":[1305],"10)":[1307],"AUC":[1315,1321],"92.31%":[1325],"98.50%":[1327],"99.82%":[1329],"99.98%":[1331,1341],"92.24%":[1335],"98.29%":[1337],"99.80%":[1339],"92.06%":[1345],"98.49%":[1347],"99.90%":[1349],"99.99%":[1351],"91.32%":[1355],"98.03%":[1357],"98.45%":[1359],"99.96%":[1361],"91.04%":[1365],"97.96%":[1367],"98.84%":[1369],"99.94%":[1371],"90.77%":[1375],"96.86%":[1377],"97.27%":[1379],"99.92%":[1381],"Note:":[1383],"different":[1384,1399,1403],"schemas":[1386],"(42":[1387],"UNSW-NB15,":[1390],"78":[1391],"vs":[1394],"13":[1395],"honeypot),":[1398],"label":[1400],"definitions,":[1401],"preprocessing":[1404],"pipelines":[1405],"prevent":[1406],"direct":[1407],"comparison.":[1408],"Lower":[1409],"live-traffic":[1410],"scores":[1411],"may":[1412],"reflect":[1413],"difficulty":[1415],"should":[1417],"be":[1419],"interpreted":[1420],"causal":[1423],"relationship.":[1424],"Script":[1427],"Descriptions":[1428],"`frozen_model_faithfulness.py`":[1430],"(NEW":[1434],"experiment":[1439],"addressing":[1440],"peer-review":[1442],"requirement":[1443],"frozen-model":[1445],"evaluation.":[1446],"seeds:1.":[1454],"Trains":[1455],"85%":[1460],"training":[1461],"partition":[1462],"(n":[1463],"9,265)2.":[1465],"Saves":[1466],"checkpoint":[1469,1481],"`frozen_models/`":[1471],"(.pkl":[1472],"sklearn,":[1474],".keras":[1475],"TensorFlow)3.":[1477],"Loads":[1478],"subsequent":[1484],"evaluations4.":[1485],"Computes":[1486,1508],"(TreeExplainer":[1489],"trees,":[1491],"KernelExplainer":[1492],"deep":[1494],"models)5.":[1495],"Runs":[1496],"(k":[1499],"0,":[1501],"1,":[1502],"...,":[1503],"13)":[1504],"retraining**6.":[1507],"rate":[1510],"**both**":[1512]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-08-17T00:00:00"}