Figure 10.
The image depicts five panels labelled A, B, C, D, and E, each showing a ranked feature contribution plot against model output value on the X-axis. Each panel lists network traffic features on the Y-axis such as L 7 P r o t o, Protocol, Client T C P Flags, Shortest Flow P K T, Longest Flow P K T, Max I P P K T Len, Num P K T S Up To 128 Bytes, Num P K T S 128 To 256 Bytes, S r c To D s t A v g Throughput, S r c To D s t Second Bytes, D s t To S r c Second Bytes, T C P Win Max In, T C P Win Max Out, In Bytes, Out Bytes, Duration In, Flow Duration Milliseconds, L 4 S r c Port, L 4 D s t Port, In P K T S, Out P K T S, Server T C P Flags, and related variables, with numeric values shown beside each label. Curved lines depict how individual feature contributions vary across negative and positive model output values. Each panel uses a different scale, illustrating distinct feature contribution ranges while maintaining a consistent feature structure across all five panels.SHAP decision: local graph for NF-ToN-IoT-v2 data set for multiple class category (a–e) – benign, DDoS, DoS, reconnaissance, theft, respectively