XTreeAD: Explainable Boosting Trees for Anomaly Detection in Cloud-native Services

XTreeAD: Explainable Boosting Trees for Anomaly Detection in Cloud-native Services Lazaros Liatsas Nearby Computing S.L. Barcelona, Spain [email protected] Godfrey Mirondo Kibalya Nearby Computing S.L. Barcelona, Spain godfrey[email protected] Angelos Antonopoulos Nearby Computing S.L. Barcelona, Spain [email protected] Abstract—Cloud-native microservice architectures are increasingly adopted in modern networked systems, including virtualized infrastructures and critical domains such as Healthcare 4.0. Ensuring their reliability requires timely anomaly detection and accurate root-cause analysis (RCA), despite challenges from service-level dependencies and indirect fault propagation. Traditional methods based on statistical thresholds or rule-based heuristics often lack the expressiveness to capture complex metric interactions and treat RCA as a separate, post hoc task. We propose XTreeAD, an explainable, supervised framework for anomaly detection and root-cause localization in microservicebased systems. XTreeAD uses an XGBoost classifier to detect anomalous system states from monitored performance and resource utilization metrics, and applies SHapley Additive exPlanations (SHAP) to compute per-service feature attributions. These are aggregated and combined with the service-call graph in a dependency-aware ranking algorithm to identify likely faulty services. Experiments on a public available dataset show that XTreeAD outperforms established baselines in detection precision, localization accuracy, and runtime efficiency. Index Terms—anomaly detection, cloud-native, explainable artificial intelligence, root-cause analysis I. INTRODUCTION Microservice architectures are widely adopted for building cloud-native applications due to their scalability, modularity, and operational agility. They play a central role in emerging networked systems, particularly in the transition from Beyond 5G to 6G infrastructures, where microservice-based applications and Virtualized or Cloud-Native Network Functions (VNFs/CNFs) enable dynamic and resilient network services. Efficient orchestration and scheduling of VNFs have become central to delivering adaptive and reliable services in virtualized network environments [1]. At the same time, the growing interconnection of such distributed systems introduces new security challenges, including resilience against large-scale and stochastic attacks [2]. Beyond telecommunications, such architectures are now essential for distributed and missioncritical platforms in domains like Healthcare 4.0 [3], where dependable, secure, and continuous service delivery is vital. However, maintaining operational resilience in such environments remains a significant challenge. The highly distributed and asynchronous nature of microservices, combined with their dynamic inter-dependencies, complicates the task of detecting anomalous behavior. Unlike monolithic systems, where faults often manifest locally, microservice anomalies can propagate across co-dependent services, resulting in delayed or ambiguous failure symptoms. As systems grow in complexity and inter-service dependencies, timely anomaly detection and accurate root-cause localization become increasingly difficult. Traditional approaches for anomaly detection and rootcause analysis (RCA) in microservice systems rely heavily on statistical thresholds, clustering, or rule-based heuristics [4]– [6]. These methods are lightweight but often assume metric independence and struggle with noisy, high-dimensional monitoring data. RCA techniques are typically applied post hoc and depend on simplistic anomaly triggers, limiting diagnostic precision. BARO [7] addresses this by integrating anomaly detection and RCA into a unified unsupervised pipeline. It uses multivariate change-point detection followed by a statistical hypothesis testing technique to rank anomalous services. While BARO avoids manual thresholds and prior system knowledge, its statistical models are less expressive than learned ones and can incur high computational cost. AI-based methods for anomaly detection, both supervised and unsupervised, have demonstrated strong performance in detecting complex anomalies [8], [9]. However, there are limited prior works in the context of metric-based, microservice anomaly detection. ADS [10] applies supervised learning to detect anomalies in containerized microservices using performance metrics and fault injection. While effective at identifying anomalous behavior, it does not support root-cause localization and provides limited interpretability. To address the opacity of black-box models, the field of explainable AI (XAI) has emerged as a means to improve transparency, accountability, and trust in AI-based systems [11]. A very popular, model-agnostic technique, SHapley Additive exPlanations (SHAP) [12], provides feature-level attributions by quantifying each input’s contribution to a model’s prediction. In the context of anomaly detection, SHAP can highlight which system metrics most strongly influenced the anomalous classification. Although such methods do not capture causal relationships explicitly, their attributions often reflect meaningful patterns of abnormal behavior observed in the system. When augmented with simple structural system knowledge, they can enable lightweight and scalable root-cause localization without requiring full causal graph inference, which is often noise- Explainer Anomaly Detector Root-Cause Localization Observation Window Monitoring Stack Service Dependency Graph rank-1 rank-krank-2 Fig. 1. System Model for end-to-end Anomaly Detection and Root-Cause Service Localization sensitive, and computationally intensive in practice. In this work, we propose XTreeAD, a framework that integrates supervised anomaly detection with explainable rootcause localization. Our method employs an Extreme Gradient Boosting (XGBoost) [13] classifier to label system states as normal or anomalous, and uses SHAP values to identify influential services contributing to the anomaly. To incorporate structural context, XTreeAD leverages the service dependency graph in a lightweight ranking procedure that prioritizes likely root causes while accounting for symptom propagation across services. The main contributions of this work are the following: 1) We propose a supervised anomaly detection framework tailored to microservice architectures, employing treebased learning with explainable outputs. 2) We develop a dependency-aware, root-cause localization strategy that integrates SHAP feature attributions with the service dependency graph. 3) We conduct experiments on a public available dataset, demonstrating superior detection accuracy, localization precision, and runtime performance compared to established baselines. The rest of the manuscript is organized as follows. Section II introduces the system model and problem formulation. Section III presents the XTreeAD framework. Section IV describes the experimental setup, baselines, and results. Section V concludes the paper and outlines directions for future work. II. SYSTEM MODEL Figure 1 illustrates the system model considered in this work, representing a cloud-native application composed of monitored microservices. This section describes the structure of monitoring data and service interactions and defines the supervised anomaly detection setting along with the two main problem objectives: identifying anomalous behavior and localizing the responsible service. A. Cloud-Native Microservice Monitoring A cloud-native application is as a set of Ninterdependent microservices, indexed as M={mi}N i=1. Cloud-native systems are commonly monitored and orchestrated using container-based platforms (e.g., Kubernetes) that enable observability, scalability, and service-level isolation. a) Per-service monitoring.: Each microservice miis continuously monitored through a collection of metrics that characterize its behavior and operational state. These metrics may include resource-level indicators such as CPU usage and memory consumption, as well as application-level metrics like request latency, error rates, and throughput, which capture how the service behaves from an external perspective. For a number of dvmonitored metrics, the collected values are concatenated into a per-service feature vector: vt,i =u(1) t,i , u(2) t,i , . . . , u(dv) t,i ∈Rdv.(1) Stacking the Nvectors produces a system-wide state vector of length d: xt=vt,1,...,vt,N ∈Rd, d =N dv.(2) b) Service dependency graph: Microservices interact through synchronous remote procedure calls (RPCs), forming a dynamic web of dependencies across the system. We represent the application structure as a directed service dependency graph: G= (M,E),(3) where an edge (mi→mj)∈ E indicates that service miinvokes service mj. This graph captures the flow of control and data between services, and plays a critical role in understanding how anomalies can propagate downstream or manifest indirectly. For each service, we define its downstream set: C(mi) = mj∈M|(mi→mj)∈ E,(4) which contains the direct dependencies of mi. For example, if m1invokes m2and m3, then C(m1) = {m2, m3}. B. Supervised Anomaly Detection A system state xtis labeled anomalous (yt= 1) if a service failure (e.g., CPU hog, memory leak, packet loss) is present. Otherwise, the state is considered normal (yt= 0). Labels are derived from historical incident logs and synthetic fault-injection experiments. Collecting Tlabeled system states yields the dataset: D=(xt, yt)T t=1, yt∈ {0,1}.(5) C. Problem Definition Given a time window of length W, the monitored system defines, for each t≥W, an observation window: Xt−W+1:t=xt−W+1,...,xt∈RW×d,(6) The problem consists of two sub-tasks: 1) Anomaly detection. Adetector f:Rd→ {0,1}assigns a predicted label ˆyt=f(xt)to each system state. Let ˆ yt−W+1:t=ˆyt−W+1,...,ˆytdenote the predicted label sequence for the window. The window Xt−W+1:tis declared anomalous if any of its states is classified as anomalous: zt= maxˆ yt−W+1:t= 1.(7) 2) Root-cause localization. Given an anomalous window (Xt⋆−W+1:t⋆, zt⋆= 1), the explainer aggregates featureattribution scores across all predicted anomalous states to compute a per-service attribution score s(mi). It then incorporates the downstream sets C(mi), derived from the service dependency graph G, to adjust scores based on dependency structure. The final output is a ranked list S ⊂ M of the top-kservices most likely responsible for the anomaly. III. XTREEAD FRAMEWORK This section presents the XTreeAD framework for explainable anomaly detection in microservice-based systems. The framework comprises of three core components: (i) an XGBoost-based anomaly detector, (ii) SHAP-based feature attribution, and (iii) a dependency-aware root-cause localization module. A. XGBoost Anomaly Detection Given the labeled dataset D={(xt, yt)}T t=1, the anomaly detector in XTreeAD is trained using XGBoost [13], a scalable implementation of extreme gradient boosting. The model takes the form f(x) = M X m=1 η hm(x),(8) where each hmis a regression tree, Mdenotes the number of boosting rounds, and ηis the learning rate. The ensemble minimizes the regularized logistic loss L(f) = T X t=1 ℓyt, pt+ Ω(f),(9) where ptis the predicted probability pt=σf(xt),(10) with σ(·)denoting the sigmoid function. A system state is flagged as anomalous when pt> τ, and an observation window is considered anomalous if it contains at least one such state. B. SHAP Feature Attributions To enable explainability, TreeSHAP [14] is applied to interpret the detector’s output in terms of per-feature contributions. For each anomalous system state xt, TreeSHAP produces a vector ϕt= (ϕt,1, . . . , ϕt,d)of contribution scores. Only the positive components defined as ϕ+ t,i = max(ϕt,i,0), are retained, as these correspond to features that increase the detector’s confidence in an anomaly. In the context of root-cause localization, such features are more indicative of abnormal behavior. These scores are then aggregated across the set Aof anomalous states within the current window: ψi=1 |A| X t′∈A ϕ+ t′,i.(11) Based on the ordering of service features in the system state vector, the aggregated feature scores vector is reshaped as ψ= [ψ1,1, . . . , ψ1,dv, ψ2,1, . . . , ψN,dv](12) to produce an N×dvmatrix Ψ. The indexing is defined such that ψi,j ≜ψ(i−1)dv+j, where ψi,j denotes the aggregated SHAP score for metric jof service mi. The importance of service miis computed by summing its row: s(mi) = dv X j=1 Ψi,j = dv X j=1 ψ(i−1)dv+j, mi∈ M.(13) Algorithm 1: Root-Cause Service Localization Input: {s(mi)}: per-service scores, k: number of root-cause candidates, {C(mi)}N i=1: downstream sets, τ: tolerance Output: S: ranked list of kservices S ← TOPkservices by s(mi); Normalize s(mi)over S; repeat foreach (i, j)with i<jin Sdo if mj∈C(mi)and s(mj)≥τ s(mi)then swap miand mj; end end until no swaps; return S C. Root-Cause Service Localization When service mjis downstream of mi, their metrics, and subsequently their SHAP scores, are correlated due to fault propagation. In such cases, a naive ranking based solely on s(mi)may overemphasize upstream services that are affected by, but not responsible for, the anomaly. To address this, the ranking is adjusted to favor downstream services. Instead of operating directly on the service dependency graph G, local downstream sets C(mi)are used for each service. Starting from the top-kservices by s(mi), upstream–downstream pairs (mi, mj)are iteratively swapped when mj∈C(mi)and s(mj)≥τ s(mi). The tolerance τ∈(0,1) determines how significant the score difference must be to justify a swap. It acts as a measure against always demoting upstream services below their downstream counterparts, hence overlooking cases where the failure actually initiates there. Only when a downstream service has a score sufficiently close to its upstream caller is it interpreted as a likely root cause and promoted in the ranking. The procedure is summarized in Algorithm 1. The final output S= [m(1), . . . , m(k)]is a ranking that prioritizes services most likely to be responsible for the anomaly, while accounting for likely propagation effects. IV. PERFORMANCE EVALUATION The proposed framework is evaluated on its ability to detect anomalies and localize their root causes in a cloud-native microservice setting. A. Dataset Evalutation is based on the Online Boutique (Figure 2) part of the BARO dataset [7], which captures resource-, performance-, and network-level metrics from ten microservices operating under a steady workload. Four types of faults are considered: CPU overload, memory leak, network delay, and packet loss. These are injected into five target services (adservice,cartservice,checkoutservice, currencyservice,productcatalogue), with each (fault, service) combination repeated five times, resulting in 100 labeled failure cases. To ensure chronological separation between training and test data, the first three fault-injection runs in each scenario are used for training, while the fourth and fifth runs are reserved for testing. This split preserves temporal order, prevents data leakage, and yields an approximate 60/40 ratio between training and test snapshots across both normal and anomalous cases. B. Experimental Setup A preliminary inspection of the BARO traces has shown that observable metric deviations typically emerge a few seconds after the fault-injection timestamp tinj. Including training instances too close to tinj risks diluting the anomalous class with healthy data, thereby confusing the model. To address this, the first 10 seconds following each injection are excluded from Frontend Checkout Ad Recommendation Productcatalog Cart Redis Cache EmailPayment CurrencyShipping Fig. 2. Online Boutique Dependency Graph training. This pre-processing is not applied on testing samples to enable fair comparison with the baselines. The XGBoost detector is trained using 300 trees, a learning rate of 0.1, depth-3 weak learners, a minimum child weight of 5, and row/column subsampling rates of 0.8 and 0.6, respectively. These settings are selected to balance model capacity with regularization. The downstream–upstream score tolerance in the localization algorithm (Algorithm 1) is fixed at τ= 0.6. C. Evaluation Metrics To assess the performance of the proposed framework, separate metrics are used for anomaly detection and root-cause localization. 1) Anomaly Detection: Detection performance is evaluated at the observation window level to enable direct comparison with baseline methods that also operate on windowed input. For each window Xt, the detector produces a binary label, which is compared against ground-truth labels derived from the fault injection schedule. Standard classification metrics are used in this context: Precision,Recall, and F1-score. 2) Root-Cause Analysis: The quality of root-cause localization is assessed using the ranking-based metrics AC@k (Accuracy at k) and its cumulative variant Avg@k, commonly used in this scenario, as defined in [7]. AC@kreflects the proportion of cases where at least one true root cause appears among the top-kranked services. Avg@kaverages this success rate across all cut-offs j= 1, . . . , k, providing a cumulative measure of ranking performance. D. Baselines We compare against two established approaches for anomaly detection and root-cause localization in microservicebased systems: 1) BARO [7]. A recent end-to-end framework that combines Multivariate Bayesian Online Change-Point Detection (M-BOCPD) for anomaly detection with a statistical hypothesis test for localization. Services are ranked by the magnitude of post-change metric deviations. 2) N-Sigma [5] [6]. A simple statistical baseline that flags anomalies when any metric exceeds N= 3 standard deviations. Root causes are inferred by ranking services based on cumulative deviation magnitudes. E. Experimental Results Tables I–III compare XTreeAD against the BARO and NSigma baselines in terms of anomaly detection performance, root-cause localization accuracy, and computational efficiency. 1) Comparison to Baselines: This subsection reports the core quantitative results of the evaluation. Performance is measured in terms of detection quality, localization accuracy, and runtime cost. a) Anomaly detection: (Table I). All methods achieve perfect window-level recall, indicating that all injected faults have been successfully detected. However, significant differences are observed in precision. XTreeAD has achieved a precision of 0.91, substantially outperforming BARO (0.80) and N-Sigma (0.60), resulting also in the highest F1-score of 0.95. The precision gain can be attributed to the tree-based learning capability of XTreeAD, which captures multivariate metric dependencies and complex decision boundaries more selectively. Unlike the univariate N-Sigma thresholding and the correlation-driven M-BOCPD used in BARO, XTreeAD is more capable to distinguish betwenn failure-induced and unrelated metric fluctuations, thereby reducing false positives. TABLE I ANOMALY DETECTION RESULTS COMPARING XTREEAD, BARO, AND N-SIGMA. Method Precision Recall F1 N-Sigma 0.60 1.00 0.75 BARO 0.80 1.00 0.89 XTreeAD 0.91 1.00 0.95 b) Root-cause localization: (Table II). XTreeAD also demonstrates consistently strong performance in root-cause identification across all ranking depths. At the strictest cutoff, AC@1 = 0.78 shows that the true root cause is ranked first in nearly 80% of cases. This exceeds BARO (0.72) and N-Sigma (0.45). Across larger candidate pools, XTreeAD maintains the lead or remains competitive, achieving an Avg@5 of 0.90. These results confirm that the SHAP-based feature attribution, when combined with dependency-aware ranking, offers reliable localization of the root-cause services. TABLE II ROOT-CAUSE LOCALIZATION ACCURACY AT VARIOUS TOP-kCUTOFFS. Method Avg@5 AC@1 AC@2 AC@3 AC@4 AC@5 N-Sigma 0.72 0.45 0.65 0.78 0.82 0.90 BARO 0.88 0.72 0.88 0.90 0.90 0.97 XTreeAD 0.90 0.78 0.90 0.93 0.95 0.95 c) Runtime efficiency: (Table III). XTreeAD processes anomaly detection at approximately 0.01 seconds per window, offering three orders of magnitude speedup compared to BARO’s M-BOCPD pipeline (44.8 seconds), and achieving comparable performance to N-Sigma (0.12 seconds). Rootcause localization completes in around 0.03 seconds, which is slightly slower than the lightweight statistical methods (both under 0.01 seconds), but still suitable for real-time use-cases. These results demonstrate that XTreeAD provides a favorable balance between accuracy and computational cost. TABLE III RUNTIME PERFORMANCE OF ANOMALY DETECTION AND ROOT-CAUSE LOCALIZATION. Method Detection Time (s) RCA Time (s) Total Time (s) N-Sigma 0.12 0.01 0.13 BARO 44.83 0.01 44.84 XTreeAD 0.01 0.03 0.04 2) Analysis of SHAP Feature Attributions: To further interpret the behavior of XTreeAD, we examine the SHAP values generated by the explainer. Both global patterns and local case studies are presented. a) Global attribution patterns.: Figure 3 presents the mean SHAP values aggregated over anomalous and normal windows. In both cases, it is evident that checkoutservice_latency has a dominant role on influencing the model’s predictions. This is easily justified by the application architecture (Figure 2), since checkoutservice is an upstream service of all the services that are injected with failures. During failures, the attribution mass spreads across several metrics, mostly related to latency. In contrast, healthy periods exhibit concentration on checkoutservice_latency. This shift suggests that XTreeAD identifies anomalies through a distributed symptom pattern rather than isolated outliers. 0.0 0.5 1.0 1.5 2.0 2.5 3.0 Mean SHAP value emailservice latency emailservice mem frontend latency cartservice cpu checkoutservice cpu cartservice latency recommendationservice mem currencyservice latency paymentservice latency checkoutservice latency (a) 01234 SHAP value main mem adservice mem cartservice cpu emailservice mem cartservice latency currencyservice latency frontend latency paymentservice latency recommendationservice mem checkoutservice latency (b) Fig. 3. Mean SHAP values for (a) anomalous and (b) normal windows. b) Local attribution case studies.: Figure 4 presents SHAP waterfall plots for two representative failure cases. In Figure 4(a), a network delay is injected into currencyservice. The dominant SHAP contributions originate from currencyservice_latency (+3.45) and checkoutservice_latency (+3.35), reflecting delay propagation from the affected service to its upstream. In Figure 4(b), a CPU overload on paymentservice results in high attribution scores on both latency (+5.23) and CPU usage (+2.90) for that service. In both cases, secondary effects—such as memory usage increases on recommendationservice—are also surfaced, while unaffected metrics receive near-zero or negative attributions. This results in an interpretable attribution profile that aligns with the final ranked list. 012345678 36 other features 0.003 = productcatalogservice latency 0.004 = adservice latency 47.997 = recommendationservice mem 0.005 = emailservice latency 7.524 = main cpu 96.866 = adservice mem 0.004 = paymentservice latency 0.8 = checkoutservice latency 0.102 = currencyservice latency 36 other features productcatalogservice latency adservice latency recommendationservice mem emailservice latency main cpu adservice mem paymentservice latency checkoutservice latency currencyservice latency +3.45 +3.35 +0.48 +0.46 +0.45 +0.44 +1.5 −0.78 −0.62 −0.49 E[f(X)] =0.05 f(x)=8.281 (a) −20246 36 other features 0.076 = frontend latency 43.54 = currencyservice mem 7.19 = main cpu 40.763 = cartservice mem 90.44 = adservice mem 46.064 = recommendationservice mem 0.049 = checkoutservice latency 4.18 = paymentservice cpu 0.005 = paymentservice latency 36 other features frontend latency currencyservice mem main cpu cartservice mem adservice mem recommendationservice mem checkoutservice latency paymentservice cpu paymentservice latency +5.23 +2.9 +0.91 +0.59 +0.32 −1.02 −0.38 −0.37 −0.28 −1.03 E[f(X)] =0.05 f(x)=6.925 (b) Fig. 4. SHAP waterfall plots for (a) a network delay in currencyservice and (b) a CPU overload in paymentservice. V. CONCLUSION In this paper we presented XTreeAD, a framework for explainable anomaly detection and root-cause localization in cloud-native microservice environments. The approach combines an XGBoost-based detector with SHAP feature attributions to provide actionable insights into anomalous behavior. A lightweight ranking adjustment, informed by service dependencies, enables effective distinction between propagated symptoms and true root causes. Evaluation on the BARO dataset has demonstrated that XTreeAD achieves high precision and recall in anomaly detection, accurate root-cause localization, and low inference latency. SHAP-based attribution further enhances interpretability at both global and local levels, supporting real-time diagnostics. An interesting future direction is to extend the current framework to more fine-grained root-cause localization at the metrics level, by identifying not only the faulty services but also the specific contributing metrics. ACKNOWLEDGMENT This work received funding from Horizon Europe under the Marie Sklodowska Curie actions: ELIXIRION (GA 101120135). REFERENCES [1] A.-S. Charismiadis, D. Tsolkas, N. Passas, D. Xenakis, and L. Merakos, “Metaheuristics as enablers for vnf scheduling in the network slice set up process,” Journal of Communications and Networks, vol. 24, no. 6, pp. 742–753, 2022. [2] A. Tsiota, D. Xenakis, N. Passas, and L. Merakos, “Multi-tier hetnets with random ddos attacks: Service probability and user load analysis,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 6190–6204, 2025. [3] J. Li and P. Carayon, “Health care 4.0: A vision for smart and connected health care,” IISE transactions on healthcare systems engineering, vol. 11, no. 3, pp. 171–180, 2021. [4] L. Wu, J. Tordsson, E. Elmroth, and O. Kao, “Microrca: Root cause localization of performance issues in microservices,” in IEEE/IFIP Network Operations and Management Symposium (NOMS), 2020. [5] J. Lin, P. Chen, and Z. Zheng, “Microscope: Pinpoint performance issues with causal graphs in micro-service environments,” in Service-Oriented Computing, C. Pahl, M. Vukovic, J. Yin, and Q. Yu, Eds. Cham: Springer International Publishing, 2018, pp. 3–20. [6] M. Li, Z. Li, K. Yin, X. Nie, W. Zhang, K. Sui, and D. Pei, “Causal inference-based root cause analysis for online service systems with intervention recognition,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, ser. KDD ’22. New York, NY, USA: Association for Computing Machinery, 2022, p. 3230–3240. [7] L. Pham, H. Ha, and H. Zhang, “Baro: Robust root cause analysis for microservices via multivariate bayesian online change point detection,” Proc. ACM Softw. Eng., vol. 1, no. FSE, Jul. 2024. [8] K. DeMedeiros, A. Hendawi, and M. Alvarez, “A survey of ai-based anomaly detection in iot and sensor networks,” Sensors, vol. 23, no. 3, p. 1352, 2023. [9] J. Soldani and A. Brogi, “Anomaly detection and failure root cause analysis in (micro) service-based cloud applications: A survey,” ACM Computing Surveys (CSUR), vol. 55, no. 3, pp. 1–39, 2022. [10] Q. Du, T. Xie, and Y. He, “Anomaly detection and diagnosis for container-based microservices with performance monitoring,” in Algorithms and Architectures for Parallel Processing, J. Vaidya and J. Li, Eds. Cham: Springer International Publishing, 2018, pp. 560–572. [11] T. Senevirathna, V. H. La, S. Marcha, B. Siniarski, M. Liyanage, and S. Wang, “A survey on xai for 5g and beyond security: Technical aspects, challenges and research directions,” IEEE Communications Surveys & Tutorials, vol. 27, no. 2, pp. 941–973, 2025. [12] S. M. Lundberg and S.-I. Lee, “A Unified Approach to Interpreting Model Predictions,” in Advances in Neural Information Processing Systems, vol. 30. Curran Associates, Inc., 2017. [13] T. Chen and C. Guestrin, “Xgboost: A scalable tree boosting system,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, ser. KDD ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 785–794. [14] S. M. Lundberg, G. G. Erion, and S.-I. Lee, “Consistent individualized feature attribution for tree ensembles,” arXiv preprint arXiv:1802.03888, 2019.