<![CDATA[Operational deployment of machine-learning (ML) intrusion detection systems (IDS) in security operations centers (SOC) often generates large volumes of alerts that are difficult to justify, prioritize, and audit. Although explainable AI (XAI) techniques are increasingly used to interpret IDS predictions, most studies remain limited to post-hoc explanations and do not translate insights into analyst-facing operational diagnostics. This paper proposes Explainability as Operational Diagnostics, a SHAP-guided workflow that operationalizes explanations into two reusable artifacts: (1) a Failure Casebook that captures recurring false-positive and false-negative patterns using explanation signatures and confidence cues, and (2) a Triage Rationale that maps attribution evidence and prediction confidence into transparent investigation priorities for SOC analysts. The workflow is evaluated using flow-based IDS data with 78 features and two supervised classifiers, XGBoost and Random Forest, applied to an explainability subset of 1,000 instances per model. In the analyzed baseline run, both models achieve perfect separation (TN = 639, TP = 361, FP = 0, FN = 0), resulting in an empty failure casebook under this controlled condition. Rather than presenting this outcome as a final operational claim, we frame it as baseline diagnostic validation and explain how the workflow would populate the casebook under realistic conditions, including class imbalance, noise, and distribution shift. Even without misclassifications, SHAP analyses reveal consistent dominant flow-level drivers across models, providing a reproducible foundation for SOC justification and model auditing. Overall, this work advances XAI for cybersecurity from prediction-centric interpretation toward actionable operational diagnostics that support trustworthy ML deployment in high-risk SOC environments.]]>
Copyrights © 2026
