{"id":"https://openalex.org/W7225810352","doi":"https://doi.org/10.3389/fcomp.2026.1972293","title":"Are explanations faithful under fire? Evaluating XAI reliability on live honeypot intrusion-detection telemetry","display_name":"Are explanations faithful under fire? Evaluating XAI reliability on live honeypot intrusion-detection telemetry","publication_year":2026,"publication_date":"2026-11-11","ids":{"openalex":"https://openalex.org/W7225810352","doi":"https://doi.org/10.3389/fcomp.2026.1972293"},"language":"en","primary_location":{"id":"doi:10.3389/fcomp.2026.1972293","doi":"https://doi.org/10.3389/fcomp.2026.1972293","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fcomp.2026.1972293","pdf_url":"https://www.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2026.1972293/pdf","source":{"id":"https://openalex.org/S4210211086","display_name":"Frontiers in Computer Science","issn_l":"2624-9898","issn":["2624-9898"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","jufo-1","norway-1","poland-20","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computer Science","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2026.1972293/pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5161488138","display_name":"Govardhan Sridhar","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I83737708","display_name":"REVA University","ror":"https://ror.org/03gtcxd54","country_code":"IN","type":"education","lineage":["https://openalex.org/I83737708"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Govardhan Sridhar","raw_affiliation_strings":["School of Computer Science and Application, REVA University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Application, REVA University","institution_ids":["https://openalex.org/I83737708"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110969478","display_name":"Jay Bharateesh Simha","orcid":"https://orcid.org/0000-0002-6733-7535","observed_orcids":["https://orcid.org/0000-0002-6733-7535"]},"institutions":[{"id":"https://openalex.org/I83737708","display_name":"REVA University","ror":"https://ror.org/03gtcxd54","country_code":"IN","type":"education","lineage":["https://openalex.org/I83737708"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"J. B. Simha","raw_affiliation_strings":["RACE, REVA University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"RACE, REVA University","institution_ids":["https://openalex.org/I83737708"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5023646723","display_name":"Rashmi Agarwal","orcid":"https://orcid.org/0000-0003-1778-7519","observed_orcids":["https://orcid.org/0000-0003-1778-7519"]},"institutions":[{"id":"https://openalex.org/I83737708","display_name":"REVA University","ror":"https://ror.org/03gtcxd54","country_code":"IN","type":"education","lineage":["https://openalex.org/I83737708"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Rashmi Agarwal","raw_affiliation_strings":["RACE, REVA University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"RACE, REVA University","institution_ids":["https://openalex.org/I83737708"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5161488138"],"corresponding_institution_ids":["https://openalex.org/I83737708"],"apc_list":{"value":1175,"currency":"CHF","value_usd":1418},"apc_paid":{"value":1175,"currency":"CHF","value_usd":1418},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"8","issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.00139999995008111,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0006000000284984708,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6852999925613403},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.6618000268936157},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.6610000133514404},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.6510999798774719},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.5983999967575073},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.49939998984336853},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.4943999946117401},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.46700000762939453},{"id":"https://openalex.org/C183121708","wikidata":"https://www.wikidata.org/wiki/Q209867","display_name":"Telemetry","level":2,"score":0.39730000495910645},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39579999446868896},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3643999993801117},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3643999993801117},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.34200000762939453},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.3411000072956085},{"id":"https://openalex.org/C113174947","wikidata":"https://www.wikidata.org/wiki/Q2859736","display_name":"Tree (set theory)","level":2,"score":0.33640000224113464},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.31790000200271606},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.29030001163482666},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.27880001068115234},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.2630999982357025},{"id":"https://openalex.org/C49781872","wikidata":"https://www.wikidata.org/wiki/Q1045555","display_name":"Maximum likelihood","level":2,"score":0.2623000144958496}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3389/fcomp.2026.1972293","doi":"https://doi.org/10.3389/fcomp.2026.1972293","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fcomp.2026.1972293","pdf_url":"https://www.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2026.1972293/pdf","source":{"id":"https://openalex.org/S4210211086","display_name":"Frontiers in Computer Science","issn_l":"2624-9898","issn":["2624-9898"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","jufo-1","norway-1","poland-20","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computer Science","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3389/fcomp.2026.1972293","doi":"https://doi.org/10.3389/fcomp.2026.1972293","is_oa":true,"landing_page_url":"https://doi.org/10.3389/fcomp.2026.1972293","pdf_url":"https://www.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2026.1972293/pdf","source":{"id":"https://openalex.org/S4210211086","display_name":"Frontiers in Computer Science","issn_l":"2624-9898","issn":["2624-9898"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","jufo-1","norway-1","poland-20","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225810352.pdf","grobid_xml":"https://content.openalex.org/works/W7225810352.grobid-xml"},"referenced_works_count":49,"referenced_works":["https://openalex.org/W2607460355","https://openalex.org/W3200432204","https://openalex.org/W4327750468","https://openalex.org/W4361205209","https://openalex.org/W4367627197","https://openalex.org/W4384787750","https://openalex.org/W4385059984","https://openalex.org/W4386865612","https://openalex.org/W4387998273","https://openalex.org/W4388948449","https://openalex.org/W4390499810","https://openalex.org/W4391348949","https://openalex.org/W4391741433","https://openalex.org/W4391986380","https://openalex.org/W4392347784","https://openalex.org/W4392364798","https://openalex.org/W4393210626","https://openalex.org/W4396930243","https://openalex.org/W4399973658","https://openalex.org/W4401512567","https://openalex.org/W4401889742","https://openalex.org/W4402526776","https://openalex.org/W4402543952","https://openalex.org/W4403389808","https://openalex.org/W4404716900","https://openalex.org/W4405444728","https://openalex.org/W4406230518","https://openalex.org/W4406882703","https://openalex.org/W4406978349","https://openalex.org/W4407008821","https://openalex.org/W4407106963","https://openalex.org/W4407184757","https://openalex.org/W4408343551","https://openalex.org/W4409173731","https://openalex.org/W4409681853","https://openalex.org/W4409965657","https://openalex.org/W4410119959","https://openalex.org/W4410246017","https://openalex.org/W4410597999","https://openalex.org/W4411641959","https://openalex.org/W4412880281","https://openalex.org/W4413014149","https://openalex.org/W4413358968","https://openalex.org/W4414146309","https://openalex.org/W4417358420","https://openalex.org/W4417500862","https://openalex.org/W6968579467","https://openalex.org/W7161852526","https://openalex.org/W7163357393"],"related_works":[],"abstract_inverted_index":{"One":[0,372],"way":[1],"to":[2,11,314,340,344,421],"validate":[3],"explanations":[4],"from":[5,40,312,362,419,442],"Explainable":[6],"Artificial":[7],"Intelligence":[8],"(XAI)":[9],"is":[10],"use":[12],"operational":[13],"data":[14],"rather":[15,462],"than":[16,145,463],"pre-existing":[17],"datasets.":[18],"Using":[19],"this":[20,34],"approach,":[21],"we":[22,36,209,222],"deployed":[23],"ten":[24],"honeypots":[25],"on":[26,350,356,368,385],"Google":[27],"Cloud":[28],"Platform":[29],"for":[30,181,189,198,219,232,251,277,296,309],"21":[31],"days.":[32],"During":[33],"time,":[35],"received":[37],"10,900":[38],"sessions":[39,228,248,264,268],"4,817":[41],"distinct":[42,64],"IP":[43,98],"addresses.":[44],"We":[45,100],"manually":[46],"tagged":[47],"each":[48,104,220],"session":[49],"via":[50],"a":[51,113,428],"human-in-the-loop":[52],"process":[53],"(operational":[54],"annotations;":[55],"Cohen\u2019s":[56],"\u03ba":[57],"=":[58,326],"0.91)":[59],"and":[60,74,96,125,136,148,165,240,280,299,320,370,405],"then":[61],"trained":[62],"six":[63],"types":[65],"of":[66,81,93,112,157,163,171,213,245,261,283,318,348,364,390,407,427,449,459],"models":[67,276,454],"(Random":[68,133,237],"Forest,":[69,134,238],"XGBoost,":[70,203],"LightGBM,":[71,185],"MLP,":[72],"LSTM,":[73],"Transformer)":[75],"with":[76,85,116],"13":[77],"features.":[78],"Each":[79],"type":[80],"model":[82,105],"was":[83,174,193,205,334,360],"evaluated":[84,101],"three":[86,178,191,234,290,393],"protocols":[87],"\u2013":[88],"record":[89],"independent,":[90],"temporal":[91],"(hour":[92],"day":[94],"holdout),":[95],"source":[97],"group.":[99],"how":[102],"well":[103],"explained":[106],"its":[107],"predictions":[108],"using":[109,456],"frozen":[110],"checkpoints":[111],"holdout":[114],"set":[115],"two":[117,351],"metrics:":[118],"AUDAC":[119,140,156,162,170,188,197],"(area":[120],"under":[121],"the":[122,146,177,186,190,196,211,214,273,292,305,341,357,381,391,453],"descriptive-accuracy":[123],"curve)":[124],"flip":[126,294,307],"rate":[127,295,308],"after":[128],"perturbation.":[129],"The":[130,266,316],"tree":[131],"ensembles":[132,236],"XGBoost":[135,159,239,310],"LightGBM)":[137],"had":[138,154,160,168],"lower":[139],"(indicating":[141],"more":[142],"faithful":[143],"attributions)":[144],"MLP":[147],"LSTM":[149],"models.":[150],"For":[151,184,202],"instance,":[152],"LightGBM":[153,300],"an":[155,161,169],"0.346,":[158],"0.348,":[164],"Random":[166,182,297],"Forest":[167,298],"0.351.":[172],"There":[173],"consistency":[175],"among":[176],"seed":[179],"runs":[180],"Forest.":[183],"average":[187],"seeds":[192,200],"consistent":[194],"but":[195],"individual":[199],"varied.":[201],"there":[204,333],"no":[206],"consistency.":[207],"When":[208],"masked":[210],"input":[212],"top":[215,392],"10":[216],"SHAP":[217,319],"features":[218,395],"model,":[221],"found":[223],"that":[224,380,452],"all":[225,233,329],"correct":[226,246,262],"malicious":[227,247,263,306],"changed":[229,250],"their":[230],"classification":[231],"tree-based":[235,274],"LightGBM).":[241],"Approximately":[242],"98.8":[243],"percent":[244],"were":[249,269,285],"MLP.":[252,288],"Under":[253],"random":[254],"masking,":[255],"by":[256,272,287,397],"contrast,":[257],"only":[258,281],"about":[259],"61%":[260],"flipped.":[265],"benign":[267,293],"not":[270,376],"flipped":[271,286],"ensemble":[275],"Seed":[278],"42,":[279],"2.2%":[282],"them":[284],"Across":[289],"seeds,":[291],"remained":[301],"near":[302],"zero,":[303],"while":[304],"ranged":[311],"71.8%":[313],"100%.":[315],"ranking":[317,363],"LIME":[321],"showed":[322],"strong":[323],"correlation":[324],"(rho":[325],"0.85\u20130.93)":[327],"across":[328],"five":[330],"models,":[331],"although":[332],"less":[335],"agreement":[336],"between":[337],"instances.":[338],"Due":[339],"transformer\u2019s":[342],"inability":[343],"converge":[345],"(F1":[346],"score":[347],"0.00":[349],"seeds;":[352],"produced":[353],"identical":[354],"outputs":[355],"third),":[358],"it":[359],"removed":[361],"faithfulness.":[365],"Ablation":[366],"studies":[367],"service-proxy":[369],"Leave":[371],"Service":[373],"Out":[374],"did":[375],"provide":[377],"any":[378],"evidence":[379],"tested":[382],"services":[383],"relied":[384],"service-identity":[386],"shortcuts.":[387],"Furthermore,":[388],"removal":[389],"behavioural":[394],"used":[396],"honeypot":[398],"signatures":[399],"(command":[400],"frequency,":[401],"authentication":[402],"failure":[403],"ratio,":[404],"number":[406],"unique":[408],"commands)":[409],"resulted":[410,434],"in":[411,415,435,438],"relatively":[412],"small":[413],"reductions":[414,437],"F1":[416,439],"scores":[417,440],"ranging":[418,441],"3.3%":[420],"3.8%":[422],"points":[423],"(approximately":[424],"84%\u201385%).":[425],"Removal":[426],"fourth":[429],"feature,":[430],"suspicious":[431],"keyword":[432],"hits,":[433],"larger":[436],"4.9\u20135.7":[443],"percentage":[444],"points.":[445],"These":[446],"high":[447],"levels":[448],"performance":[450],"suggest":[451],"are":[455],"greater":[457],"amounts":[458],"contextual":[460],"information,":[461],"simply":[464],"replicating":[465],"signature-based":[466],"rules.":[467]},"counts_by_year":[],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-11-12T00:00:00"}