What are the main open research challenges for XAI in intrusion detection systems?

The main open research challenges for XAI in intrusion detection systems are addressing instability and uncertainty in explanations, adapting to dynamic network environments, moving from local to global explanations, ensuring robustness against adversarial attacks, defining tailored explainability standards for IDSs, and developing user-centric explanation frameworks for different stakeholders.

According to the source, several open research challenges limit the real-world effectiveness of XAI for intrusion detection systems. First, XAI methods often produce feature importance estimates that can be inconsistent across model instances, so improving the stability and reliability of explanations is critical in high-stakes security settings. Second, network traffic patterns evolve constantly, so ML-based IDSs must adapt autonomously to changing conditions to remain effective. Third, most XAI methods provide only local explanations for individual decisions; combining local and global interpretability would help analysts identify trends and vulnerabilities more comprehensively. Fourth, attackers can exploit interpretability to evade detection, so strategies are needed to enhance ML-IDS resilience under adversarial conditions. Fifth, there is a need for a standardized definition of explainability specific to IDSs, aligned with principles like confidentiality, integrity, and availability, to enable consistent evaluation. Finally, different stakeholders such as security analysts, developers, and managers have distinct needs, requiring adaptive explanation frameworks to improve usability and relevance.