Analysis protocol v1.2 and pipeline: When Does Grouping Redundant Features Improve Explanation Reliability in Intrusion Detection? A Controlled Multi-Dataset Evaluation

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Pre-registered analysis protocol (version 1.2, finalised 3 October 2026) and confirmatory pipeline (script revision 1.2.1) for a controlled multi-dataset evaluation of cluster-level versus size-matched random grouping of redundant features in intrusion-detection explanations. The primary datasets are UNSW-NB15 and CICIoMT2024; CICIoT2023 is a secondary dataset. The protocol fixes, before any confirmatory result exists, the data splits, the four tree-based models, the Shapley-based explainers, the outcome measures, and the inference rule (corrected resampled t-test, Nadeau and Bengio, 2003, with Holm adjustment over 24 primary comparisons). It also discloses the analyses carried out before deposit, including a Monte Carlo repeatability check of the Shapley estimator on training partitions only. The package contains the protocol (Markdown and PDF), the pipeline script, its 35 tests on synthetic data, pre-deposit evidence logs, reporting rules for flagged results, a deviations log, and SHA-256 checksums of all files. No timing run and no confirmatory run had been made, and no result on the evaluation or test partitions of the real datasets had been read, at the time of deposit. The datasets themselves are not included.