Interpretability of Intrusion Detection Models: An Information Visualization Approach - Ferreira, Tiago Martins; Bertazzoli, Carlos Eduardo Silva; Lucas, Thiago José; Moraes, Eduardo Alves; Lopes, Alessandra de Souza; Alves, Luis Augusto de Campos (Anais do Congresso Latino-Americano de Software Livre e Tecnologias Abertas (Latinoware); 2025: Anais do XXII Congresso Latino-Americano de Software Livre e Tecnologias AbertasDO - 10.5753/latinoware.2025.16461, 2025)
This article explores information visualization to enhance the interpretability of intrusion detection models, focusing on Machine Learning and Explainable Artificial Intelligence (XAI). Given the complexity of cyberattacks and the ”black-box” nature of many models, this work proposes the use of techniques such as SHAP and visualizations to make model decisions, such as those from Random Forest, more understandable. Using the CICIDS2017 dataset, the study aims to apply preprocessing, train the model, interpret its decisions with SHAP, and generate explanatory visualizations. The objective is to increase confidence and adoption of intrusion detection systems, making them more transparent and auditable for security analysts. Results showed that the Random Forest model achieved an accuracy of 99.9%, indicating its high capability to distinguish between benign and malicious network traffic. More importantly, SHAP visualizations, including importance, summary, and dependence plots, provided valuable insights into model behavior.