Add Colab notebook — full pipeline in one file

explainable_ids_full_pipeline.ipynb

@@ -0,0 +1,743 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "# Explainable IDS — Full Pipeline\n",
+    "**ICCN-INE2 Project 5 | NSL-KDD | MLP + LSTM + 1D-CNN | SHAP + LIME**\n",
+    "\n",
+    "Run all cells (Runtime → Run all) or Ctrl+F9. Takes ~10-15 min on Colab GPU."
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## 0. Setup"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "!pip install -q torch numpy pandas scikit-learn datasets shap lime matplotlib scipy"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "import os, sys, json, time, random, pickle\n",
+    "import numpy as np\n",
+    "import pandas as pd\n",
+    "import torch\n",
+    "import torch.nn as nn\n",
+    "from torch.utils.data import TensorDataset, DataLoader\n",
+    "from sklearn.preprocessing import LabelEncoder, MinMaxScaler\n",
+    "from sklearn.metrics import classification_report, confusion_matrix, roc_auc_score, average_precision_score\n",
+    "from datasets import load_dataset\n",
+    "import shap\n",
+    "from lime import lime_tabular\n",
+    "from scipy.stats import spearmanr, pearsonr\n",
+    "import matplotlib.pyplot as plt\n",
+    "import warnings\n",
+    "warnings.filterwarnings('ignore')\n",
+    "\n",
+    "# Reproducibility\n",
+    "SEED = 42\n",
+    "random.seed(SEED)\n",
+    "np.random.seed(SEED)\n",
+    "torch.manual_seed(SEED)\n",
+    "torch.backends.cudnn.deterministic = True\n",
+    "torch.backends.cudnn.benchmark = False\n",
+    "\n",
+    "DEVICE = torch.device('cuda' if torch.cuda.is_available() else 'cpu')\n",
+    "print(f'Device: {DEVICE}')\n",
+    "if DEVICE.type == 'cuda':\n",
+    "    print(f'GPU: {torch.cuda.get_device_name(0)}')"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## 1. Load & Preprocess NSL-KDD"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "FEATURE_NAMES = [\n",
+    "    'duration', 'protocol_type', 'service', 'flag',\n",
+    "    'src_bytes', 'dst_bytes', 'land', 'wrong_fragment', 'urgent',\n",
+    "    'hot', 'num_failed_logins', 'logged_in', 'num_compromised',\n",
+    "    'root_shell', 'su_attempted', 'num_root', 'num_file_creations',\n",
+    "    'num_shells', 'num_access_files', 'num_outbound_cmds',\n",
+    "    'is_host_login', 'is_guest_login',\n",
+    "    'count', 'srv_count',\n",
+    "    'serror_rate', 'srv_serror_rate', 'rerror_rate', 'srv_rerror_rate',\n",
+    "    'same_srv_rate', 'diff_srv_rate', 'srv_diff_host_rate',\n",
+    "    'dst_host_count', 'dst_host_srv_count',\n",
+    "    'dst_host_same_srv_rate', 'dst_host_diff_srv_rate',\n",
+    "    'dst_host_same_src_port_rate', 'dst_host_srv_diff_host_rate',\n",
+    "    'dst_host_serror_rate', 'dst_host_srv_serror_rate',\n",
+    "    'dst_host_rerror_rate', 'dst_host_srv_rerror_rate'\n",
+    "]\n",
+    "CATEGORICAL_COLS = ['protocol_type', 'service', 'flag']\n",
+    "\n",
+    "# Load from HuggingFace\n",
+    "ds = load_dataset('Mireu-Lab/NSL-KDD')\n",
+    "df_train = ds['train'].to_pandas()\n",
+    "df_test = ds['test'].to_pandas()\n",
+    "print(f'Train: {len(df_train)} | Test: {len(df_test)}')\n",
+    "\n",
+    "# Class distribution\n",
+    "print('\\nTrain distribution:')\n",
+    "print(df_train['class'].value_counts())\n",
+    "print('\\nTest distribution:')\n",
+    "print(df_test['class'].value_counts())"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Encode target (binary: anomaly=0, normal=1)\n",
+    "class_names = ['anomaly', 'normal']\n",
+    "le_y = LabelEncoder()\n",
+    "y_train = le_y.fit_transform(df_train['class'].values)\n",
+    "y_test = le_y.transform(df_test['class'].values)\n",
+    "\n",
+    "# Encode categoricals\n",
+    "df_tr, df_te = df_train.copy(), df_test.copy()\n",
+    "label_encoders = {}\n",
+    "for col in CATEGORICAL_COLS:\n",
+    "    le = LabelEncoder()\n",
+    "    le.fit(df_tr[col])\n",
+    "    known = set(le.classes_)\n",
+    "    df_te[col] = df_te[col].apply(lambda x: x if x in known else le.classes_[0])\n",
+    "    df_tr[col] = le.transform(df_tr[col])\n",
+    "    df_te[col] = le.transform(df_te[col])\n",
+    "    label_encoders[col] = le\n",
+    "    print(f'Encoded {col}: {len(le.classes_)} categories')\n",
+    "\n",
+    "# Scale features\n",
+    "scaler = MinMaxScaler()\n",
+    "X_train = scaler.fit_transform(df_tr[FEATURE_NAMES].values.astype(np.float32))\n",
+    "X_test = scaler.transform(df_te[FEATURE_NAMES].values.astype(np.float32))\n",
+    "\n",
+    "print(f'\\nX_train: {X_train.shape} | X_test: {X_test.shape}')\n",
+    "print(f'y_train: {np.bincount(y_train)} | y_test: {np.bincount(y_test)}')"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## 2. Model Definitions"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "class MLP_IDS(nn.Module):\n",
+    "    def __init__(self, in_dim=41, num_classes=2):\n",
+    "        super().__init__()\n",
+    "        self.net = nn.Sequential(\n",
+    "            nn.Linear(in_dim, 256), nn.BatchNorm1d(256), nn.ReLU(), nn.Dropout(0.3),\n",
+    "            nn.Linear(256, 128), nn.BatchNorm1d(128), nn.ReLU(), nn.Dropout(0.2),\n",
+    "            nn.Linear(128, 64), nn.ReLU(),\n",
+    "            nn.Linear(64, num_classes)\n",
+    "        )\n",
+    "        for m in self.modules():\n",
+    "            if isinstance(m, nn.Linear):\n",
+    "                nn.init.xavier_uniform_(m.weight)\n",
+    "                nn.init.zeros_(m.bias)\n",
+    "    def forward(self, x): return self.net(x)\n",
+    "    def count_parameters(self): return sum(p.numel() for p in self.parameters() if p.requires_grad)\n",
+    "\n",
+    "class LSTM_IDS(nn.Module):\n",
+    "    def __init__(self, in_dim=41, hidden_dim=64, num_layers=2, num_classes=2):\n",
+    "        super().__init__()\n",
+    "        self.lstm = nn.LSTM(1, hidden_dim, num_layers, batch_first=True, dropout=0.2)\n",
+    "        self.fc = nn.Sequential(nn.Linear(hidden_dim, 32), nn.ReLU(), nn.Linear(32, num_classes))\n",
+    "    def forward(self, x):\n",
+    "        out, (h_n, _) = self.lstm(x.unsqueeze(-1))\n",
+    "        return self.fc(h_n[-1])\n",
+    "    def count_parameters(self): return sum(p.numel() for p in self.parameters() if p.requires_grad)\n",
+    "\n",
+    "class CNN1D_IDS(nn.Module):\n",
+    "    def __init__(self, in_dim=41, num_classes=2):\n",
+    "        super().__init__()\n",
+    "        self.conv = nn.Sequential(\n",
+    "            nn.Conv1d(1, 64, 3, padding=1), nn.BatchNorm1d(64), nn.ReLU(),\n",
+    "            nn.Conv1d(64, 128, 3, padding=1), nn.BatchNorm1d(128), nn.ReLU(),\n",
+    "            nn.AdaptiveAvgPool1d(8)\n",
+    "        )\n",
+    "        self.fc = nn.Sequential(nn.Linear(128*8, 64), nn.ReLU(), nn.Dropout(0.2), nn.Linear(64, num_classes))\n",
+    "    def forward(self, x):\n",
+    "        x = self.conv(x.unsqueeze(1))\n",
+    "        return self.fc(x.view(x.size(0), -1))\n",
+    "    def count_parameters(self): return sum(p.numel() for p in self.parameters() if p.requires_grad)\n",
+    "\n",
+    "for name, cls in [('MLP', MLP_IDS), ('LSTM', LSTM_IDS), ('CNN1D', CNN1D_IDS)]:\n",
+    "    m = cls()\n",
+    "    print(f'{name}: {m.count_parameters():,} parameters')"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## 3. Train All Models"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "EPOCHS = 50\n",
+    "BATCH_SIZE = 256\n",
+    "LR = 1e-3\n",
+    "\n",
+    "# Data loaders\n",
+    "train_ds = TensorDataset(torch.FloatTensor(X_train), torch.LongTensor(y_train))\n",
+    "test_ds = TensorDataset(torch.FloatTensor(X_test), torch.LongTensor(y_test))\n",
+    "train_loader = DataLoader(train_ds, batch_size=BATCH_SIZE, shuffle=True)\n",
+    "test_loader = DataLoader(test_ds, batch_size=BATCH_SIZE)\n",
+    "\n",
+    "# Class weights\n",
+    "counts = np.bincount(y_train)\n",
+    "weights = 1.0 / counts.astype(np.float32)\n",
+    "weights = weights / weights.sum() * len(weights)\n",
+    "class_weights = torch.FloatTensor(weights).to(DEVICE)\n",
+    "\n",
+    "def train_model(model, model_name):\n",
+    "    print(f'\\n{\"=\"*60}')\n",
+    "    print(f'Training {model_name} ({model.count_parameters():,} params) on {DEVICE}')\n",
+    "    print(f'{\"=\"*60}')\n",
+    "    \n",
+    "    model.to(DEVICE)\n",
+    "    criterion = nn.CrossEntropyLoss(weight=class_weights)\n",
+    "    optimizer = torch.optim.Adam(model.parameters(), lr=LR, weight_decay=1e-4)\n",
+    "    scheduler = torch.optim.lr_scheduler.ReduceLROnPlateau(optimizer, patience=5, factor=0.5)\n",
+    "    \n",
+    "    best_f1, history = 0, {'train_loss': [], 'test_acc': []}\n",
+    "    best_state = None\n",
+    "    t0 = time.time()\n",
+    "    \n",
+    "    for epoch in range(EPOCHS):\n",
+    "        model.train()\n",
+    "        total_loss = 0\n",
+    "        for xb, yb in train_loader:\n",
+    "            xb, yb = xb.to(DEVICE), yb.to(DEVICE)\n",
+    "            optimizer.zero_grad()\n",
+    "            loss = criterion(model(xb), yb)\n",
+    "            loss.backward()\n",
+    "            optimizer.step()\n",
+    "            total_loss += loss.item() * len(yb)\n",
+    "        \n",
+    "        # Evaluate\n",
+    "        model.eval()\n",
+    "        preds, probs, labels = [], [], []\n",
+    "        with torch.no_grad():\n",
+    "            for xb, yb in test_loader:\n",
+    "                xb = xb.to(DEVICE)\n",
+    "                out = model(xb)\n",
+    "                preds.append(out.argmax(1).cpu().numpy())\n",
+    "                probs.append(torch.softmax(out, 1).cpu().numpy())\n",
+    "                labels.append(yb.numpy())\n",
+    "        preds = np.concatenate(preds)\n",
+    "        probs = np.concatenate(probs)\n",
+    "        labels = np.concatenate(labels)\n",
+    "        \n",
+    "        report = classification_report(labels, preds, output_dict=True)\n",
+    "        wf1 = report['weighted avg']['f1-score']\n",
+    "        acc = report['accuracy']\n",
+    "        test_loss = total_loss / len(y_train)\n",
+    "        scheduler.step(test_loss)\n",
+    "        \n",
+    "        history['train_loss'].append(total_loss / len(y_train))\n",
+    "        history['test_acc'].append(acc)\n",
+    "        \n",
+    "        if wf1 > best_f1:\n",
+    "            best_f1 = wf1\n",
+    "            best_state = {k: v.cpu().clone() for k, v in model.state_dict().items()}\n",
+    "        \n",
+    "        if (epoch+1) % 10 == 0 or epoch == 0:\n",
+    "            print(f'  Epoch {epoch+1:3d}/{EPOCHS} | Loss: {total_loss/len(y_train):.4f} | Acc: {acc:.4f} | F1: {wf1:.4f}')\n",
+    "    \n",
+    "    dt = time.time() - t0\n",
+    "    \n",
+    "    # Load best and final eval\n",
+    "    model.load_state_dict(best_state)\n",
+    "    model.eval()\n",
+    "    preds, probs, labels = [], [], []\n",
+    "    with torch.no_grad():\n",
+    "        for xb, yb in test_loader:\n",
+    "            xb = xb.to(DEVICE)\n",
+    "            out = model(xb)\n",
+    "            preds.append(out.argmax(1).cpu().numpy())\n",
+    "            probs.append(torch.softmax(out, 1).cpu().numpy())\n",
+    "            labels.append(yb.numpy())\n",
+    "    preds = np.concatenate(preds)\n",
+    "    probs = np.concatenate(probs)\n",
+    "    labels = np.concatenate(labels)\n",
+    "    \n",
+    "    roc = roc_auc_score(labels, probs[:, 1])\n",
+    "    pr = average_precision_score(labels, probs[:, 1])\n",
+    "    \n",
+    "    print(f'\\n  Time: {dt:.1f}s | Best F1: {best_f1:.4f} | ROC-AUC: {roc:.4f} | PR-AUC: {pr:.4f}')\n",
+    "    print(classification_report(labels, preds, target_names=class_names))\n",
+    "    print('Confusion Matrix:')\n",
+    "    print(confusion_matrix(labels, preds))\n",
+    "    \n",
+    "    return model, {'f1': best_f1, 'roc_auc': roc, 'pr_auc': pr, 'time': dt, 'history': history, 'preds': preds, 'probs': probs, 'labels': labels}\n",
+    "\n",
+    "# Train all 3\n",
+    "models = {}\n",
+    "results = {}\n",
+    "for name, cls in [('mlp', MLP_IDS), ('lstm', LSTM_IDS), ('cnn1d', CNN1D_IDS)]:\n",
+    "    models[name], results[name] = train_model(cls(), name.upper())"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Summary table\n",
+    "print(f'{\"Model\":<8} {\"Params\":>8} {\"W-F1\":>8} {\"ROC-AUC\":>9} {\"PR-AUC\":>8} {\"Time\":>8}')\n",
+    "print('-'*50)\n",
+    "for name in ['mlp', 'lstm', 'cnn1d']:\n",
+    "    r = results[name]\n",
+    "    p = models[name].count_parameters()\n",
+    "    print(f'{name:<8} {p:>8,} {r[\"f1\"]:>8.4f} {r[\"roc_auc\"]:>9.4f} {r[\"pr_auc\"]:>8.4f} {r[\"time\"]:>7.1f}s')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Training curves\n",
+    "fig, axes = plt.subplots(1, 2, figsize=(14, 5))\n",
+    "for name in ['mlp', 'lstm', 'cnn1d']:\n",
+    "    axes[0].plot(results[name]['history']['train_loss'], label=name.upper())\n",
+    "    axes[1].plot(results[name]['history']['test_acc'], label=name.upper())\n",
+    "axes[0].set_xlabel('Epoch'); axes[0].set_ylabel('Train Loss'); axes[0].set_title('Training Loss'); axes[0].legend(); axes[0].grid(alpha=0.3)\n",
+    "axes[1].set_xlabel('Epoch'); axes[1].set_ylabel('Test Accuracy'); axes[1].set_title('Test Accuracy'); axes[1].legend(); axes[1].grid(alpha=0.3)\n",
+    "plt.tight_layout(); plt.show()"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## 4. SHAP Explainability Analysis"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Move MLP to CPU for SHAP\n",
+    "mlp_cpu = models['mlp'].cpu().eval()\n",
+    "\n",
+    "def predict_fn(X):\n",
+    "    with torch.no_grad():\n",
+    "        return torch.softmax(mlp_cpu(torch.FloatTensor(X)), 1).numpy()\n",
+    "\n",
+    "# Background & samples\n",
+    "bg_idx = np.random.choice(len(X_train), 100, replace=False)\n",
+    "exp_idx = np.random.choice(len(X_test), 150, replace=False)\n",
+    "\n",
+    "explainer = shap.KernelExplainer(predict_fn, X_train[bg_idx])\n",
+    "print('Computing SHAP values for 150 test samples (this takes a few minutes)...')\n",
+    "shap_values = explainer.shap_values(X_test[exp_idx], nsamples=200, silent=True)\n",
+    "print('Done!')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Global feature importance (anomaly class)\n",
+    "mean_abs_shap = np.abs(shap_values[0]).mean(axis=0)\n",
+    "feature_importance = sorted(zip(FEATURE_NAMES, mean_abs_shap), key=lambda x: x[1], reverse=True)\n",
+    "\n",
+    "print('Top 15 features by mean |SHAP| (anomaly class):')\n",
+    "for i, (f, v) in enumerate(feature_importance[:15]):\n",
+    "    print(f'  {i+1:2d}. {f:35s} {v:.4f}')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# SHAP summary plot\n",
+    "shap.summary_plot(shap_values[0], X_test[exp_idx], feature_names=FEATURE_NAMES, max_display=15)"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# SHAP bar plot\n",
+    "plt.figure(figsize=(10, 6))\n",
+    "top15 = feature_importance[:15]\n",
+    "plt.barh(range(15), [v for _, v in top15][::-1], color='steelblue')\n",
+    "plt.yticks(range(15), [f for f, _ in top15][::-1])\n",
+    "plt.xlabel('Mean |SHAP value|')\n",
+    "plt.title('Top 15 Features — MLP (Anomaly Class)')\n",
+    "plt.tight_layout(); plt.show()"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Single prediction explanation (force plot)\n",
+    "idx = 0\n",
+    "pred = predict_fn(X_test[exp_idx[idx:idx+1]])\n",
+    "print(f'Sample prediction: anomaly={pred[0][0]:.3f}, normal={pred[0][1]:.3f}')\n",
+    "print(f'True label: {class_names[y_test[exp_idx[idx]]]}')\n",
+    "shap.force_plot(explainer.expected_value[0], shap_values[0][idx], X_test[exp_idx[idx]], feature_names=FEATURE_NAMES, matplotlib=True)"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## 5. LIME Analysis"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "lime_explainer = lime_tabular.LimeTabularExplainer(\n",
+    "    X_train, feature_names=FEATURE_NAMES, class_names=class_names,\n",
+    "    discretize_continuous=True, random_state=SEED\n",
+    ")\n",
+    "\n",
+    "n_lime = 30\n",
+    "lime_idx = np.random.choice(len(X_test), n_lime, replace=False)\n",
+    "all_top_features = {}\n",
+    "\n",
+    "print(f'Running LIME on {n_lime} samples...')\n",
+    "for i, idx in enumerate(lime_idx):\n",
+    "    exp = lime_explainer.explain_instance(X_test[idx], predict_fn, num_features=10, top_labels=1)\n",
+    "    pred_class = np.argmax(predict_fn(X_test[idx].reshape(1, -1)))\n",
+    "    for fw in exp.as_list(label=pred_class):\n",
+    "        fname = fw[0].split(' ')[0]\n",
+    "        all_top_features[fname] = all_top_features.get(fname, 0) + 1\n",
+    "    if (i+1) % 10 == 0:\n",
+    "        print(f'  {i+1}/{n_lime} done')\n",
+    "\n",
+    "lime_sorted = sorted(all_top_features.items(), key=lambda x: x[1], reverse=True)\n",
+    "print(f'\\nTop 10 features by LIME frequency:')\n",
+    "for f, c in lime_sorted[:10]:\n",
+    "    print(f'  {f:35s}: {c}/{n_lime} explanations')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# LIME vs SHAP comparison\n",
+    "fig, axes = plt.subplots(1, 2, figsize=(16, 6))\n",
+    "\n",
+    "# SHAP\n",
+    "top10_shap = feature_importance[:10]\n",
+    "axes[0].barh(range(10), [v for _, v in top10_shap][::-1], color='steelblue')\n",
+    "axes[0].set_yticks(range(10)); axes[0].set_yticklabels([f for f, _ in top10_shap][::-1])\n",
+    "axes[0].set_xlabel('Mean |SHAP value|'); axes[0].set_title('SHAP Top 10')\n",
+    "\n",
+    "# LIME\n",
+    "top10_lime = lime_sorted[:10]\n",
+    "axes[1].barh(range(10), [v for _, v in top10_lime][::-1], color='coral')\n",
+    "axes[1].set_yticks(range(10)); axes[1].set_yticklabels([f for f, _ in top10_lime][::-1])\n",
+    "axes[1].set_xlabel(f'Frequency in top-10 (out of {n_lime})'); axes[1].set_title('LIME Top 10')\n",
+    "\n",
+    "plt.suptitle('SHAP vs LIME Feature Rankings', fontsize=14)\n",
+    "plt.tight_layout(); plt.show()\n",
+    "\n",
+    "# Rank correlation\n",
+    "shap_ranks = {f: i for i, (f, _) in enumerate(feature_importance[:20])}\n",
+    "lime_ranks = {f: i for i, (f, _) in enumerate(lime_sorted[:20])}\n",
+    "common = set(shap_ranks.keys()) & set(lime_ranks.keys())\n",
+    "if len(common) >= 5:\n",
+    "    rho, p = spearmanr([shap_ranks[f] for f in common], [lime_ranks[f] for f in common])\n",
+    "    print(f'\\nSHAP vs LIME Spearman correlation: {rho:.4f} (p={p:.4f}) over {len(common)} common features')"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## 6. Explanation Stability Evaluation"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "def compute_shap_stability(explainer, sample, epsilon, n_perturbs=10):\n",
+    "    \"\"\"Compute SENS_MAX and PCC for one sample.\"\"\"\n",
+    "    rng = np.random.RandomState(SEED)\n",
+    "    base = np.array(explainer.shap_values(sample.reshape(1,-1), nsamples=100, silent=True))\n",
+    "    base = base[0].flatten() if isinstance(base, list) else base.flatten()\n",
+    "    \n",
+    "    max_delta, pccs = 0, []\n",
+    "    for _ in range(n_perturbs):\n",
+    "        noise = rng.uniform(-epsilon, epsilon, sample.shape)\n",
+    "        perturbed = np.clip(sample + noise, 0, 1)\n",
+    "        p_shap = np.array(explainer.shap_values(perturbed.reshape(1,-1), nsamples=100, silent=True))\n",
+    "        p_shap = p_shap[0].flatten() if isinstance(p_shap, list) else p_shap.flatten()\n",
+    "        max_delta = max(max_delta, np.linalg.norm(p_shap - base))\n",
+    "        if np.std(base) > 1e-8 and np.std(p_shap) > 1e-8:\n",
+    "            pccs.append(pearsonr(base, p_shap)[0])\n",
+    "    return max_delta, np.mean(pccs) if pccs else 0.0\n",
+    "\n",
+    "# Test across epsilon values\n",
+    "epsilons = [0.01, 0.03, 0.05]\n",
+    "n_stability = 8\n",
+    "stability_idx = np.random.choice(len(X_test), n_stability, replace=False)\n",
+    "stability_results = {}\n",
+    "\n",
+    "for eps in epsilons:\n",
+    "    sens_list, pcc_list = [], []\n",
+    "    print(f'\\n--- SHAP Stability (eps={eps}) ---')\n",
+    "    for i, idx in enumerate(stability_idx):\n",
+    "        sm, pc = compute_shap_stability(explainer, X_test[idx], eps, n_perturbs=8)\n",
+    "        sens_list.append(sm); pcc_list.append(pc)\n",
+    "        if (i+1) % 4 == 0:\n",
+    "            print(f'  {i+1}/{n_stability} | SENS_MAX={sm:.4f} | PCC={pc:.4f}')\n",
+    "    \n",
+    "    stability_results[eps] = {'sens_max': np.mean(sens_list), 'pcc': np.mean(pcc_list)}\n",
+    "    status = 'STABLE' if np.mean(pcc_list) > 0.6 else 'UNSTABLE'\n",
+    "    print(f'  Mean SENS_MAX={np.mean(sens_list):.4f} | Mean PCC={np.mean(pcc_list):.4f} [{status}]')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# LIME stochastic stability\n",
+    "print('--- LIME Stochastic Stability ---')\n",
+    "lime_corrs = []\n",
+    "for i, idx in enumerate(stability_idx[:6]):\n",
+    "    weight_vecs = []\n",
+    "    for seed in range(10):\n",
+    "        le_obj = lime_tabular.LimeTabularExplainer(X_train, feature_names=FEATURE_NAMES, discretize_continuous=True, random_state=seed)\n",
+    "        exp = le_obj.explain_instance(X_test[idx], predict_fn, num_features=len(FEATURE_NAMES))\n",
+    "        w = np.zeros(len(FEATURE_NAMES))\n",
+    "        for key, val in dict(exp.as_list()).items():\n",
+    "            for j, fn in enumerate(FEATURE_NAMES):\n",
+    "                if fn in key: w[j] = val; break\n",
+    "        weight_vecs.append(w)\n",
+    "    corrs = []\n",
+    "    for a in range(10):\n",
+    "        for b in range(a+1, 10):\n",
+    "            if np.std(weight_vecs[a]) > 1e-8 and np.std(weight_vecs[b]) > 1e-8:\n",
+    "                corrs.append(spearmanr(weight_vecs[a], weight_vecs[b])[0])\n",
+    "    mc = np.mean(corrs) if corrs else 0\n",
+    "    lime_corrs.append(mc)\n",
+    "    print(f'  Sample {i+1}/6 | Mean Spearman: {mc:.4f}')\n",
+    "\n",
+    "lime_status = 'STABLE' if np.mean(lime_corrs) > 0.6 else 'UNSTABLE'\n",
+    "print(f'\\nOverall LIME stability: {np.mean(lime_corrs):.4f} [{lime_status}]')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Faithfulness evaluation\n",
+    "print('--- Faithfulness (Feature Masking) ---')\n",
+    "faith_results = {k: [] for k in [3, 5, 10]}\n",
+    "\n",
+    "for idx in stability_idx[:10]:\n",
+    "    sample = X_test[idx]\n",
+    "    sv = np.array(explainer.shap_values(sample.reshape(1,-1), nsamples=100, silent=True))\n",
+    "    sv = sv[0].flatten() if isinstance(sv, list) else sv.flatten()\n",
+    "    \n",
+    "    base_conf = predict_fn(sample.reshape(1,-1))[0]\n",
+    "    pred_cls = np.argmax(base_conf)\n",
+    "    \n",
+    "    for k in faith_results:\n",
+    "        masked = sample.copy()\n",
+    "        masked[np.argsort(np.abs(sv))[-k:]] = 0.0\n",
+    "        drop = base_conf[pred_cls] - predict_fn(masked.reshape(1,-1))[0][pred_cls]\n",
+    "        faith_results[k].append(float(drop))\n",
+    "\n",
+    "for k, scores in faith_results.items():\n",
+    "    print(f'  Top-{k} masking: confidence drop = {np.mean(scores):.4f} +/- {np.std(scores):.4f}')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Stability summary plot\n",
+    "fig, axes = plt.subplots(1, 3, figsize=(16, 5))\n",
+    "\n",
+    "# SENS_MAX\n",
+    "eps_list = list(stability_results.keys())\n",
+    "axes[0].plot(eps_list, [stability_results[e]['sens_max'] for e in eps_list], 'o-', color='steelblue', markersize=8)\n",
+    "axes[0].set_xlabel('Perturbation epsilon'); axes[0].set_ylabel('SENS_MAX')\n",
+    "axes[0].set_title('SHAP Sensitivity (lower = more stable)'); axes[0].grid(alpha=0.3)\n",
+    "\n",
+    "# PCC\n",
+    "pcc_vals = [stability_results[e]['pcc'] for e in eps_list]\n",
+    "colors = ['green' if p > 0.6 else 'red' for p in pcc_vals]\n",
+    "axes[1].bar(range(len(eps_list)), pcc_vals, color=colors)\n",
+    "axes[1].set_xticks(range(len(eps_list))); axes[1].set_xticklabels([f'eps={e}' for e in eps_list])\n",
+    "axes[1].axhline(y=0.6, color='gray', linestyle='--', label='Threshold (0.6)')\n",
+    "axes[1].set_ylabel('Mean PCC'); axes[1].set_title('SHAP Stability'); axes[1].legend()\n",
+    "\n",
+    "# Faithfulness\n",
+    "ks = list(faith_results.keys())\n",
+    "axes[2].bar(range(len(ks)), [np.mean(faith_results[k]) for k in ks],\n",
+    "            yerr=[np.std(faith_results[k]) for k in ks], color='coral', capsize=5)\n",
+    "axes[2].set_xticks(range(len(ks))); axes[2].set_xticklabels([f'Top-{k}' for k in ks])\n",
+    "axes[2].set_ylabel('Confidence drop'); axes[2].set_title('Faithfulness (higher = better)')\n",
+    "\n",
+    "plt.suptitle('Explanation Stability Evaluation (SAFARI Framework)', fontsize=14)\n",
+    "plt.tight_layout(); plt.show()"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "## 7. Security Implications Summary"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Analyze which top SHAP features are attacker-manipulable\n",
+    "manipulable = {'src_bytes', 'dst_bytes', 'hot', 'num_failed_logins', 'duration', 'num_compromised',\n",
+    "               'root_shell', 'su_attempted', 'num_root', 'num_file_creations', 'num_shells', 'num_access_files'}\n",
+    "partial = {'count', 'srv_count', 'serror_rate', 'srv_serror_rate', 'rerror_rate', 'srv_rerror_rate',\n",
+    "           'protocol_type', 'flag', 'service'}\n",
+    "non_manip = {'dst_host_count', 'dst_host_srv_count', 'dst_host_same_srv_rate', 'dst_host_diff_srv_rate',\n",
+    "             'dst_host_same_src_port_rate', 'dst_host_srv_diff_host_rate', 'dst_host_serror_rate',\n",
+    "             'dst_host_srv_serror_rate', 'dst_host_rerror_rate', 'dst_host_srv_rerror_rate',\n",
+    "             'same_srv_rate', 'diff_srv_rate', 'srv_diff_host_rate'}\n",
+    "\n",
+    "print('SECURITY ANALYSIS: Top 15 Features by Manipulability')\n",
+    "print('='*70)\n",
+    "manip_count = {'Manipulable': 0, 'Partial': 0, 'Non-manipulable': 0}\n",
+    "for i, (f, v) in enumerate(feature_importance[:15]):\n",
+    "    if f in manipulable:\n",
+    "        status = 'MANIPULABLE'\n",
+    "        manip_count['Manipulable'] += 1\n",
+    "    elif f in partial:\n",
+    "        status = 'PARTIAL'\n",
+    "        manip_count['Partial'] += 1\n",
+    "    else:\n",
+    "        status = 'NON-MANIPULABLE'\n",
+    "        manip_count['Non-manipulable'] += 1\n",
+    "    print(f'  {i+1:2d}. {f:35s} SHAP={v:.4f}  [{status}]')\n",
+    "\n",
+    "print(f'\\nSummary: {manip_count}')\n",
+    "if manip_count['Non-manipulable'] > manip_count['Manipulable']:\n",
+    "    print('-> Model relies more on non-manipulable features -> MORE ROBUST against evasion')\n",
+    "else:\n",
+    "    print('-> Model relies more on manipulable features -> LESS ROBUST against evasion')"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Final summary\n",
+    "print('\\n' + '='*60)\n",
+    "print('FINAL RESULTS SUMMARY')\n",
+    "print('='*60)\n",
+    "print(f'\\n1. MODEL COMPARISON:')\n",
+    "for name in ['mlp', 'lstm', 'cnn1d']:\n",
+    "    r = results[name]\n",
+    "    print(f'   {name.upper():6s}: F1={r[\"f1\"]:.4f} | ROC-AUC={r[\"roc_auc\"]:.4f} | PR-AUC={r[\"pr_auc\"]:.4f}')\n",
+    "\n",
+    "print(f'\\n2. EXPLANATION STABILITY (SAFARI):')\n",
+    "for eps in epsilons:\n",
+    "    sr = stability_results[eps]\n",
+    "    status = 'STABLE' if sr['pcc'] > 0.6 else 'UNSTABLE'\n",
+    "    print(f'   eps={eps}: SENS_MAX={sr[\"sens_max\"]:.4f} | PCC={sr[\"pcc\"]:.4f} [{status}]')\n",
+    "print(f'   LIME: Spearman={np.mean(lime_corrs):.4f} [{\"STABLE\" if np.mean(lime_corrs) > 0.6 else \"UNSTABLE\"}]')\n",
+    "\n",
+    "print(f'\\n3. FAITHFULNESS:')\n",
+    "for k in [3, 5, 10]:\n",
+    "    print(f'   Top-{k}: confidence drop = {np.mean(faith_results[k]):.4f}')\n",
+    "\n",
+    "print(f'\\n4. SECURITY: Top features manipulability = {manip_count}')\n",
+    "print('\\nDone!')"
+   ]
+  }
+ ],
+ "metadata": {
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "name": "python",
+   "version": "3.10.0"
+  },
+  "accelerator": "GPU",
+  "colab": {
+   "gpuType": "T4"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 4
+}