Jul 2026· Recent Progress in Science and Engineering· 0 citations· 14 references
TL;DR
An explainable machine learning framework for network intrusion detection using the CICIDS2017 dataset is proposed, which improves detection accuracy, reduces false positives, and supports informed decision-making, thereby enhancing the transparency, trustworthiness, and practical applicability of intrusion detection systems.
Abstract
The increasing scale, speed, and sophistication of cyberattacks have rendered traditional rule-based intrusion detection systems (IDS) insufficient for modern network environments. While machine learning (ML)-based IDSs have significantly improved detection capabilities, their black-box nature limits trust, interpretability, and practical deployment in real-world security operations. To address this challenge, this paper proposes an explainable machine learning framework for network intrusion detection using the CICIDS2017 dataset. The framework integrates multiple supervised learning models, including baseline and ensemble classifiers, and evaluates them using standard performance metrics such as accuracy, precision, recall, F1-score, and ROC-AUC. To enhance transparency, Shapley Additive exPlanations (SHAP) are employed to quantify feature contributions and provide both global and instance-level interpretability of model predictions. Experimental results demonstrate that ensemble models achieve superior detection performance while maintaining high interpretability. Furthermore, the explainability analysis reveals key traffic characteristics associated with different attack behaviors, providing deeper insight into attack behavior and supporting security analysts in interpreting intrusion alerts. The proposed approach improves detection accuracy, reduces false positives, and supports informed decision-making, thereby enhancing the transparency, trustworthiness, and practical applicability of intrusion detection systems.
The speed of cyberattack evolution and the growing sophistication of new attacks have revealed critical limitations of traditional IDS, specifically in terms of adaptability and interpretability. Although modern machine learning models are highly accurate at detection, their black-box nature makes them opaque, reducing analysts' trust and limiting their practical deployment in security-critical environments. To address this issue, this study proposes an interpretable and adaptive intrusion detection framework that achieves high detection performance and explainable decision-making. The proposed framework is built on a SHAP-enhanced ensemble learning architecture that incorporates heterogeneous classifiers, including tree-based and deep neural network models, to effectively capture complex and diverse attack behaviors. SHAP provide global and instance-level feature attributions, allowing security analysts to understand, validate, and trust model predictions. In addition, adaptive learning mechanisms are introduced to address concept drift in streaming network traffic, making it more robust under changing threat conditions. The framework is tested on benchmark intrusion detection datasets, such as NSL-KDD and CICIDS, with realistic multi-class attack scenarios. Experimental results show that the proposed approach achieves over 98% detection accuracy, an F1-score of more than 0.97, and approximately a 20% reduction in the false positive rate compared with state-of-the-art methods. Overall, the study validates the use of combining ensemble learning with SHAP-based explainability to achieve highly accurate, transparent and adaptive IDS that can be used in next-generation cybersecurity environments.
Alycia Sebastian, S. Priscila, B. M. Praveen· FMDB Transactions on Sustain...· 0 citations
This paper presents an Intrusion Detection System (IDS) grounded in Explainable Artificial Intelligence (XAI) to enhance transparency, reliability, and user trust in IoT security. To make detection decisions interpretable and accountable, the system employs ensemble machine learning for real-time anomaly detection and integrates two complementary explainability methods: SHapley Additive exPlanations (SHAP), and Local Interpretable Model-agnostic Explanations (LIME). A Digital Twin (DT) module continuously mirrors device behaviour, supporting predictive threat analysis and early anomaly identification by detecting deviations from expected operational baselines. The framework is evaluated on the TON_IoT benchmark dataset using accuracy, precision, recall, F1-score, ROC-AUC, and the Matthews Correlation Coefficient (MCC). Experimental results demonstrate that Random Forest and XGBoost achieve the highest accuracy of 0.996. In the XAI comparison, SHAP outperforms LIME across all metrics $(\mathbf{F} \mathbf{1} \boldsymbol{=} \mathbf{0. 9 9 5}$, $\mathbf{R O C}-\mathbf{A U C} \boldsymbol{=} \mathbf{0. 9 9 8}$ vs. $\mathbf{0. 9 9 3}$ for LIME), confirming its stronger explanatory and predictive effectiveness. While the current framework focuses on XAIdriven detection and digital twin integration, the architecture is designed to accommodate future extensions, including blockchain with zero-knowledge proof (ZKP) protocols for tamper.
Ohood Alharbi, R. Shaikh, Raheel Hassan et al.· International Conference on...· 0 citations
The study demonstrates that integrating deep learning with stable explainable AI offers a practical and trustworthy solution for zero-day intrusion detection, contributing validated evidence to an area where explanation reliability is rarely examined.
Cyberattacks are growing in complexity, and machine-learning-based intrusion detection systems (IDS) are increasingly adopted to support scalable threat monitoring. However, high-performing models can be operationally difficult to deploy when their decisions are not interpretable or auditable. This paper studies explainability as a decision-support component in an IDS workflow rather than as a purely visual add-on. Using the UNSW-NB15 benchmark, we compare three widely used classifiers—Random Forest (RF), Decision Tree (DT), and Support Vector Machine (SVM)—and then analyse the strongest performer (RF) with
post-hoc
explainability tools: Local Interpretable Model-Agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP). RF achieved 95.3% accuracy (precision 94.8%, recall 96.1%, F1-score 95.4%), exceeding DT and SVM on the same split. LIME and SHAP consistently highlighted traffic-volume and duration-related features (e.g., destination bytes, source bytes, and flow duration) as influential drivers of intrusion predictions, providing actionable hypotheses for analyst triage and policy refinement. We further discuss how explanation outputs can be operationalized in cybersecurity training labs through auditable “rationale artifacts,” while clarifying that any observed reduction in false positives should be interpreted as the outcome of explanation-guided interventions (e.g., threshold tuning and triage rule adjustments) rather than a direct causal effect of generating explanations. Finally, we outline necessary research extensions—controlled baselines, robustness testing, and explanation stability/faithfulness analysis—to ensure reliable deployment of LIME/SHAP in safety-critical IDS settings.
Ahmad Almufarreh, Ashfaq Ahmad, Muhammad Arshad et al.· Frontiers of Computer Scienc...· 0 citations
The recent trend of Software-Defined Networking (SDN) has posed significant cybersecurity challenges as a result of its centralized control architecture, dynamic traffic behavior, and high programmability. Although these attributes improve network flexibility and management, they also increase vulnerability to Distributed Denial-of-Service (DDoS) attacks that can overwhelm network resources and disrupt services. Traditional signature- and rule-based detection methods may struggle with evolving traffic patterns and generate excessive false alarms. Machine learning offers a more promising solution that can learn the complex traffic patterns and separate malicious traffic from normal traffic. Most machine learning models, however, are black-box models that provide only superficial insight into the model predictions. Explainable Artificial Intelligence (XAI) addresses this limitation by identifying influential traffic features and providing interpretable evidence for detection decisions. This research develops an explainable machine learning-based framework for accurate, transparent, and reliable DDoS attack detection in an SDN environment. Several machine learning models are assessed, and XAI techniques are applied to explain the results of the predictions at global and instance levels. Gradient Boosting, Logistic Regression, AdaBoost, and Gaussian Naive Bayes were evaluated on 104,345 network-flow records using a 70:30 training–testing split. Gradient Boosting achieved the strongest performance, with 99.88% training accuracy, 99.87% testing accuracy, a testing F1-score of 99.84%, and a 0.20% miss rate. SHAP identified the most influential traffic features, while LIME linked individual predictions to feature-specific contributions. The proposed framework therefore combines reliable DDoS detection with transparent, analyst-oriented decision support for SDN security monitoring.
J. Malik, N. Naz, Muhammad Saleem et al.· Italian National Conference...· 0 citations
Advanced persistent threats, zero-day exploits, encrypted command-and-control traffic, and botnet campaigns continue to reduce the reliability of conventional intrusion detection systems because static detectors provide limited transparency and weak adaptation under traffic drift. This paper presents an explainable and adaptive machine learning framework that integrates a LightGBM threat detector, SHAP-based decision explanations, density-aware concept drift detection, active incremental updating, and a contextual bandit defense policy. LightGBM is adopted because its leaf-wise gradient boosting structure provides high discrimination for heterogeneous flow features while maintaining low inference latency and native feature-importance support. The framework is evaluated on CIC-IDS2017, UNSW-NB15, and ToN_IoT using stratified train-validation-test splits, leakage prevention, five-run validation, and a 48-hour Kafka-based streaming simulation. The proposed model achieved 99.1% accuracy, 98.7% F1-score, 98.4% recall, and a 0.007 false alarm rate. During streaming evaluation, 14 adaptive model updates reduced mean detection latency from 27.4 s to 11.2 s, while SHAP explanations based on DNS entropy, JA3 rarity, packet interval, and flow-duration evidence reduced analyst triage time by 23%. Comparative results show that the proposed explainable adaptive pipeline improves detection reliability, reduces false alarms, and supports auditable mitigation decisions better than static and black-box IDS baselines.
P. A. Prakash, Salath Joseph A, A. M et al.· 2026 7th International Confe...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
