Figure 8.
he visual depicts five S H A P summary plots labelled A, B, C, D, and E, each showing the impact of features on model output value along the X-axis labelled S H A P value impact on model output. The Y-axis in each panel lists ranked network traffic features such as L 7 P r o t o, Protocol, Client T C P Flags, Shortest Flow P K T, Longest Flow P K T, Max I P P K T Len, Num P K T S Up To 128 Bytes, Num P K T S 128 To 256 Bytes, S r c To D s t Avg Throughput, S r c To D s t Second Bytes, D s t To S r c Second Bytes, T C P Win Max In, T C P Win Max Out, In Bytes, Out Bytes, Duration In, Flow Duration Milliseconds, L 4 S r c Port, L 4 D s t Port, In P K T S, Server T C P Flags, Min I P P K T Len, and Max T T L. Each panel includes a vertical scale labelled Feature value with High at the top and Low at the bottom. Dots distributed horizontally around zero depict how higher and lower feature values contribute positively or negatively to the model output, with each panel showing a distinct distribution while maintaining a consistent feature set across all five panels.Global interoperability: summary plots for NF-ToN-IoT-v2 data set for multiple class category (a–e) – benign, DDoS, DoS, reconnaissance, theft, respectively