Figure 9.
The visual depicts five panels labelled A, B, C, D, and E, each showing a heatmap of the S H A P value impact on model output across multiple instances on the X-axis. The Y-axis in each panel lists ranked network traffic features such as L 7 P r o t o, Protocol, Client T C P Flags, Shortest Flow P K T, Longest Flow P K T, Max I P P K T Len, Num P K T S Up To 128 Bytes, Num P K T S 128 To 256 Bytes, S r c To D s t A v g Throughput, S r c To D s t Second Bytes, In Bytes, T C P Win Max In, L 4 S r c Port, L 4 D s t Port, Server T C P Flags, and Sum of 32 other features. Each panel includes a horizontal trace labelled f x above the heatmap, indicating overall model output across instances. The colour scale represents negative to positive S H A P values, showing how individual feature contributions vary across instances, with each panel using a different contribution range while maintaining a consistent feature structure.SHAP heatmap for NF-ToN-IoT-v2 data set for multiple class category (a–e) – benign, DDoS, DoS, reconnaissance, theft, respectively