Investigating Sample Selection Methods for Fast and Precise Feature Attribution Explanations in Intrusion Detection

In cybersecurity, the speed of intrusion detection is critical for effective defense. This paper investigates efficient sampling strategies to accelerate the feature attribution generation process in tabular datasets, which is the common format of intrusion detection. Traditional feature attribution methods, while valuable for understanding model behavior, often suffer from high computational complexity, making them impractical for real-time cybersecurity applications. In this study, we evaluate various sampling strategies to assess their ability to maintain the fidelity of feature attributions while significantly reducing the computation time required. Our findings reveal that Latin Hypercube Sampling (LHS) and its improved versions offer a compelling balance between speed and accuracy, achieving nearly identical performance using only 0.1 % of the full training set. These results underscore the potential of optimized sampling methods in enhancing the responsiveness of cybersecurity systems, paving the way for faster, more accurate intrusion detection mechanisms.