Comparing Analysis of Global and Local Visualization Methods for Explainable AI SHAP: A Study Case on Network Anomaly Detection

Network anomaly detection is of paramount importance in the field of cybersecurity. This phenomenon can be attributed to the increasing complexity of network traffic and the sophistication of contemporary cyber threats. However, the inherent opacity in deep learning models, such as artificial neural networks (ANNs), poses significant challenges in comprehending and entrusting the system’s decisions. This study addresses these issues by evaluating and comparing the interpretability of global and local SHAP (SHapley Additive exPlanations) visualizations applied to an ANN (artificial neural network)-based network anomaly detection system. In this study, we employed the NF-UNSW-NB15 v2 dataset to conduct a series of experiments utilizing five SHAP visual- izations: bar, beeswarm, waterfall, cohort attack, and decision plots. The evaluation is conducted employing a range of quantitative and qualitative metrics, encompassing time to insight, rendering complexity, entropy, edge density, and file size. The findings indicate that the bar plot attains the most expeditious time to insight (0.0999s local, 0.2012s global), the least complex rendering (17 local, 31 global), and the most substantial entropy (0.7646 local, 0.8353 global). Consequently, it is the most efficacious in global and local interpretability. Conversely, cohort plots record the highest file sizes and edge densities, thereby highlighting their complexity. These findings establish a framework for the selection of visualization methods in real-time and high-dimensional cybersecurity applications.