| # Speaker Notes — Explainable IDS Presentation |
|
|
| ## Slide 1 |
| Introduce the project as an IDS for network traffic that is not only accurate but explainable. Emphasize that this is the exam project for the module and that the final notebook runs the full pipeline end-to-end in Colab. |
|
|
| ## Slide 2 |
| Explain the practical motivation: IDS predictions must be interpretable because analysts need justifications. The project studies both interpretability and the security risk of exposing explanations. |
|
|
| ## Slide 3 |
| Frame the talk around five questions. This gives examiners a clear evaluation structure: model performance, explanation quality, stability, and threat analysis. |
|
|
| ## Slide 4 |
| Explain NSL-KDD and the important train/test distribution shift. Mention why scaling is necessary, especially for SHAP/LIME perturbations. |
|
|
| ## Slide 5 |
| Use this slide to show that the work is reproducible and not only conceptual: data loading, preprocessing, models, XAI, stability, and threat analysis are all implemented. |
|
|
| ## Slide 6 |
| Present the three models and justify why they are lightweight. Stress fair comparison: same preprocessing, same split, same training setup. |
|
|
| ## Slide 7 |
| Discuss the numerical results. LSTM slightly outperformed the MLP and CNN, but all models are in a similar range, which makes the explainability comparison meaningful. |
|
|
| ## Slide 8 |
| Explain SHAP as feature attribution. Top features include logged_in and multiple error-rate statistics, which are meaningful for IDS decisions. |
| |
| ## Slide 9 |
| This is an important exam point: XAI methods can disagree. SHAP and LIME provide useful information, but their low rank correlation shows explanations are method-dependent. |
| |
| ## Slide 10 |
| Explain stability in simple terms: similar inputs should receive similar explanations. SHAP passes only for very small perturbation; LIME average stability is just above threshold. |
| |
| ## Slide 11 |
| Interpret confidence drop as a faithfulness check. If removing top features changes model confidence, explanations are meaningful, not just decorative. |
| |
| ## Slide 12 |
| Tie explainability back to cybersecurity. The model seems to rely on several sensor-side features, which is good, but explanation leakage remains a security concern. |
| |
| ## Slide 13 |
| This slide shows maturity: acknowledge limitations rather than overclaiming. It also prepares answers for exam questions. |
| |
| ## Slide 14 |
| End with the main message: explainability adds value, but trust in explanations must be measured, and explanation access must be managed securely. |
| |
| ## Slide 15 |
| Invite questions. Be ready to answer: why NSL-KDD, why SHAP/LIME, why LSTM won, and what stability means. |
| |
