Does Ordinality in Encoding Matter for XAI? A Case Study on Explainable IDS
摘要
In this paper, we propose Fusion SHAP, a novel algorithm designed to overcome the limitations of SHAP in handling one-hot encoded features. While SHAP provides individual explanations for each feature, it struggles with generating meaningful insights for categorical variables represented through one-hot encoding. Recent publications have attempted to address this problem by using label encoding, which theoretically may introduce issues related to ordinality. Fusion SHAP addresses this by offering both individual explanations for each one-hot encoded feature and a merged explanation that considers the collective impact of these features. We present the mathematical proof for the correctness of our algorithm and demonstrate its effectiveness through experiments on a network intrusion detection system (IDS) dataset. Our results compare the explanations generated by Fusion SHAP with those of the original SHAP algorithm under one-hot encoding and label encoding. Specifically, we evaluate the explanations for seven different types of cyberattacks, including DDoS, Backdoor, Injection, Password, Ransomware, Scanning, and XSS. Finally, we analyze the correlation between feature importance and attack type, showcasing the advantages of Fusion SHAP in enhancing the interpretability of IDS models.