Figure 11.
The image depicts five panels labelled A, B, C, D, and E, each showing ranked feature contribution trajectories plotted against model output value on the X-axis. The Y-axis in each panel lists network traffic features such as L 7 P r o t o, Protocol, Client T C P Flags, Shortest Flow P K T, Longest Flow P K T, Max I P P K T Len, Num P K T S Up To 128 Bytes, Num P K T S 128 To 256 Bytes, S r c To D s t Avg Throughput, S r c To D s t Second Bytes, D s t To S r c Second Bytes, T C P Win Max In, T C P Win Max Out, In Bytes, Out Bytes, Duration In, Flow Duration Milliseconds, L 4 S r c Port, L 4 D s t Port, In P K T S, Out P K T S, Server T C P Flags, Min I P P K T Len, and Max T T L, with numeric values shown beside each label. Multiple overlapping curves in each panel depict how feature contributions vary across negative and positive model output values. Each panel uses a different contribution range and scale, illustrating distinct feature influence patterns while maintaining a consistent feature structure across all five panels.SHAP decision: global graph for NF-ToN-IoT-v2 data set for multiple class category (a–e) – benign, DDoS, DoS, reconnaissance, theft, respectively