{"id":"https://openalex.org/W7127377791","doi":"https://doi.org/10.1109/rivf68649.2025.11365034","title":"Mind the Gap: On the Practical Utility of SHAP for Deep Learning-Based Intrusion Detection","display_name":"Mind the Gap: On the Practical Utility of SHAP for Deep Learning-Based Intrusion Detection","publication_year":2025,"publication_date":"2025-12-18","ids":{"openalex":"https://openalex.org/W7127377791","doi":"https://doi.org/10.1109/rivf68649.2025.11365034"},"language":null,"primary_location":{"id":"doi:10.1109/rivf68649.2025.11365034","is_oa":false,"landing_page_url":"https://doi.org/10.1109/rivf68649.2025.11365034","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 RIVF International Conference on Computing and Communication Technologies (RIVF)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5124344022","display_name":"Phuc Hao Do","orcid":null},"institutions":[{"id":"https://openalex.org/I4210125720","display_name":"Danang Architecture University","ror":"https://ror.org/03aebk093","country_code":"VN","type":"education","lineage":["https://openalex.org/I4210125720"]}],"countries":["VN"],"is_corresponding":false,"raw_author_name":"Phuc Hao Do","raw_affiliation_strings":["Danang Architecture University,Department of Software Engineering,Da Nang,Vietnam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Danang Architecture University,Department of Software Engineering,Da Nang,Vietnam","institution_ids":["https://openalex.org/I4210125720"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038961438","display_name":"Tran Duc Le","orcid":"https://orcid.org/0000-0003-3735-0314"},"institutions":[{"id":"https://openalex.org/I1921588","display_name":"University of Wisconsin\u2013Stout","ror":"https://ror.org/01gb8pc70","country_code":"US","type":"education","lineage":["https://openalex.org/I1921588"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tran Duc Le","raw_affiliation_strings":["Statistics & Computer Science University of Wisconsin-Stout,Department of Mathematics,Menomonie,WI,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Statistics & Computer Science University of Wisconsin-Stout,Department of Mathematics,Menomonie,WI,USA","institution_ids":["https://openalex.org/I1921588"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041417996","display_name":"Truong Duy Dinh","orcid":"https://orcid.org/0000-0002-9993-9792"},"institutions":[{"id":"https://openalex.org/I4210095603","display_name":"Vietnam Posts and Telecommunications Group (Vietnam)","ror":"https://ror.org/00q0e7f94","country_code":"VN","type":"company","lineage":["https://openalex.org/I4210095603"]}],"countries":["VN"],"is_corresponding":false,"raw_author_name":"Truong Duy Dinh","raw_affiliation_strings":["Posts and Telecommunications Institute of Technology,Faculty of Information Security,Ha Noi,Vietnam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Posts and Telecommunications Institute of Technology,Faculty of Information Security,Ha Noi,Vietnam","institution_ids":["https://openalex.org/I4210095603"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017967256","display_name":"Van Dai Pham","orcid":"https://orcid.org/0000-0003-1363-0784"},"institutions":[{"id":"https://openalex.org/I109689652","display_name":"FPT University","ror":"https://ror.org/03esj4g97","country_code":"VN","type":"education","lineage":["https://openalex.org/I109689652"]}],"countries":["VN"],"is_corresponding":false,"raw_author_name":"Van Dai Pham","raw_affiliation_strings":["FPT University,Metropolia Vietnam,Ha Noi,Viet Nam"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FPT University,Metropolia Vietnam,Ha Noi,Viet Nam","institution_ids":["https://openalex.org/I109689652"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.6700059,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"364","last_page":"369"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.8396000266075134,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.8396000266075134,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.06930000334978104,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.01850000023841858,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sophistication","display_name":"Sophistication","score":0.6916000247001648},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5910999774932861},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.47780001163482666},{"id":"https://openalex.org/keywords/transparency","display_name":"Transparency (behavior)","score":0.4449000060558319},{"id":"https://openalex.org/keywords/preprocessor","display_name":"Preprocessor","score":0.4406999945640564},{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.435699999332428},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.38749998807907104}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7742000222206116},{"id":"https://openalex.org/C168725872","wikidata":"https://www.wikidata.org/wiki/Q991663","display_name":"Sophistication","level":2,"score":0.6916000247001648},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5910999774932861},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5163999795913696},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.47780001163482666},{"id":"https://openalex.org/C2780233690","wikidata":"https://www.wikidata.org/wiki/Q535347","display_name":"Transparency (behavior)","level":2,"score":0.4449000060558319},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.4406999945640564},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.435699999332428},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4124999940395355},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.38749998807907104},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3707999885082245},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3659000098705292},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3596000075340271},{"id":"https://openalex.org/C10551718","wikidata":"https://www.wikidata.org/wiki/Q5227332","display_name":"Data pre-processing","level":2,"score":0.35249999165534973},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.32420000433921814},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.31839999556541443},{"id":"https://openalex.org/C2780712339","wikidata":"https://www.wikidata.org/wiki/Q5165204","display_name":"Contextualization","level":3,"score":0.3109000027179718},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.30889999866485596},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.27399998903274536}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/rivf68649.2025.11365034","is_oa":false,"landing_page_url":"https://doi.org/10.1109/rivf68649.2025.11365034","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 RIVF International Conference on Computing and Communication Technologies (RIVF)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.4457261562347412}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":10,"referenced_works":["https://openalex.org/W2342408547","https://openalex.org/W2516809705","https://openalex.org/W2891503716","https://openalex.org/W3022604549","https://openalex.org/W3043530913","https://openalex.org/W3111390419","https://openalex.org/W3126673261","https://openalex.org/W4200090997","https://openalex.org/W4393145669","https://openalex.org/W4409573889"],"related_works":[],"abstract_inverted_index":{"The":[0,141],"increasing":[1],"sophistication":[2],"of":[3,9,50,63,93,107],"cyber":[4],"threats":[5],"necessitates":[6],"the":[7,47,61,82,104,108],"use":[8,74],"advanced":[10],"techniques":[11],"like":[12,138],"Deep":[13,76],"Learning":[14],"(DL)":[15],"for":[16,95],"Network":[17,78],"Intrusion":[18],"Detection":[19],"Systems":[20],"(NIDS.":[21],"While":[22],"DL":[23],"models":[24],"achieve":[25],"high":[26],"accuracy,":[27],"their":[28,32],"\u201cblack-box\u201d":[29],"nature":[30],"hinders":[31],"adoption":[33],"in":[34,118,177],"real-world":[35],"security":[36,130],"operations,":[37],"where":[38],"transparency":[39],"and":[40,153,164,174],"trust":[41],"are":[42,155],"paramount.":[43],"This":[44],"paper":[45],"investigates":[46],"practical":[48,175],"challenges":[49],"applying":[51],"Explainable":[52],"AI":[53],"(xAI)":[54],"to":[55,102,129,133,157],"this":[56],"problem":[57,117],"by":[58],"critically":[59],"analyzing":[60],"outputs":[62,125,160],"a":[64,69,75,87,114,168],"standard":[65,134],"xAI":[66,124,146],"framework":[67],"on":[68,81],"high-performance":[70],"NIDS":[71],"model.":[72],"We":[73,98],"Neural":[77],"(DNN)":[79],"trained":[80],"widelyused":[83],"CIC-IDS-2017":[84],"dataset":[85],"as":[86],"baseline":[88],"model,":[89],"achieving":[90],"an":[91],"F1-score":[92],"0.99":[94],"attack":[96],"detection.":[97],"then":[99],"employ":[100],"SHAP":[101],"scrutinize":[103],"operational":[105],"utility":[106],"generated":[109],"explanations.":[110],"Our":[111],"analysis":[112],"reveals":[113],"critical":[115],"\u201clast-mile\u201d":[116],"explainability,":[119],"demonstrating":[120],"that":[121,144],"raw,":[122],"unprocessed":[123],"can":[126,147],"be":[127],"unintelligible":[128],"practitioners":[131],"due":[132],"data":[135],"preprocessing":[136],"steps":[137],"feature":[139],"scaling.":[140],"results":[142],"show":[143],"while":[145],"identify":[148],"influential":[149],"features,":[150],"significant":[151],"postprocessing":[152],"contextualization":[154],"required":[156],"translate":[158],"these":[159],"into":[161],"genuinely":[162],"transparent":[163],"actionable":[165],"insights,":[166],"highlighting":[167],"crucial":[169],"gap":[170],"between":[171],"theoretical":[172],"explainability":[173],"application":[176],"cybersecurity.":[178]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2026-02-04T00:00:00"}