Abstract
<title>Abstract</title> <p>Machine learning based intrusion detection systems achieve excellent accuracy but remain black boxes, and it is unclear whether the evidence they rely on transfers across attack domains. This paper applies a three-layer explainable AI framework, comprising SHAP, LIME, and permutation importance, to seven classifiers trained on a nine-feature temporal representation harmonized across CIC-IDS2017 (multi-vector attack traffic) and CTU-13 (botnet traffic). All non-kernel detectors exceed 0.99 ROC-AUC using temporal features alone. Explanations, however, reveal domain-specific reliance: multi-vector attacks are dominated by volumetric and packet-size evidence, whereas botnets are exposed almost entirely by inter-arrival-time regularity, and cross-dataset importance rankings correlate weakly (mean Spearman rho of +0.01). By taking the minimum importance across datasets, algorithms, and XAI methods, we distill a consensus set of robust temporal signatures, led by inter-arrival-time variability, source-byte ratio, and average packet size, that remains informative in both domains. The results demonstrate that XAI can convert black box detectors into auditable, transferable temporal evidence for trustworthy intrusion detection.</p>