Feature Attribution in 5G Intrusion Detection: A Statistical vs. Logic-Based Comparison

Logic-based explanations outperform statistical methods on key metrics: The paper compares SHAP (statistical) and VoTE-XAI (logic-based) approaches and finds that logic-based feature attribution performs better on sparsity (conciseness), stability (consistency across similar attacks), and efficiency (speed of explanation generation)—all critical factors for security teams responding to alerts in real time.

Statistical methods like SHAP may over-correlate features: The research identifies limitations in dominant statistical approaches to feature attribution, suggesting they can associate too many correlated features with security alerts, potentially overwhelming analysts with less actionable information compared to logic-based alternatives.

Explainability is essential for trustworthy security systems: The paper emphasizes that as 5G networks handle critical applications, ML-based intrusion detection systems must move beyond simply flagging threats to providing reliable, interpretable explanations—enabling security teams to understand why an alert was raised and respond appropriately.

Explanation quality matters across different attack types: Testing across three 5G-relevant datasets with multiple attack scenarios reveals that the choice of explanation method significantly impacts how consistently and clearly different types of security threats are interpreted, suggesting no one-size-fits-all solution.

Speed and clarity of explanations directly impact incident response: By measuring efficiency alongside accuracy, the paper highlights that explanations must be generated quickly enough to support real-time security operations, not just be theoretically sound.