Jul 2026· Applied Science and Engineering Journal for Advanced Research· Vol 5, pp. 1-16· 0 citations· 12 references
TL;DR
An explainable network intrusion detection framework that integrates Mutual Information-based feature selection, a stacking ensemble classifier, and SHapley Additive exPlanations (SHAP) that provides both global and local interpretations of model decisions is proposed.
Abstract
The rapid evolution of cyber threats has significantly increased the demand for intelligent intrusion detection systems (IDSs) capable of accurately distinguishing malicious network activities from legitimate traffic. Traditional signature-based IDSs are often ineffective against previously unseen attacks, while many machine learning-based approaches suffer from limited interpretability despite achieving high detection performance. To address these challenges, this paper proposes an explainable network intrusion detection framework that integrates Mutual Information (MI)-based feature selection, a stacking ensemble classifier, and SHapley Additive exPlanations (SHAP). The proposed framework is evaluated using the UNSW-NB15 benchmark dataset. During preprocessing, categorical attributes are transformed using label encoding, highly skewed numerical features are normalized through logarithmic transformation, and robust scaling is applied to mitigate the influence of outliers. Mutual Information is employed to rank feature relevance, and the twenty most informative features are selected to reduce computational complexity while preserving discriminative information. A stacking ensemble model comprising XGBoost, LightGBM, and CatBoost as base learners, with Logistic Regression serving as the meta-learner, is then trained for binary intrusion detection. Experimental evaluation demonstrates that the proposed model achieves an accuracy of 93.40%, precision of 94.50%, recall of 95.22%, F1-score of 94.86%, and an ROC-AUC score of 98.74%. Furthermore, SHAP-based explainability provides both global and local interpretations of model decisions, identifying sttl, sbytes, and synack as the most influential features contributing to attack detection. The experimental results indicate that the proposed framework offers a robust balance between predictive performance and interpretability, making it suitable for practical cybersecurity applications.
Machine learning-based network intrusion detection systems are often optimized using aggregate accuracy, although operational security depends on the reliable detection of rare, high-impact attacks. This paper proposes a data-preserving intrusion detection framework that combines hybrid feature selection, heterogeneous ensemble learning and cost-sensitive optimization for imbalanced multi-class attack detection. The method first applies Mutual Information filtering and Recursive Feature Elimination to reduce the NSL-KDD feature space from 122 one-hot encoded attributes to 25 discriminative features. Four classifiers, Random Forest, XGBoost, Support Vector Machine and K-Nearest Neighbors, are evaluated individually, and a stacking ensemble is constructed using Logistic Regression as a meta-learner. Class imbalance is addressed by balanced class weighting rather than by synthetic oversampling, preserving the original minority-class observations. Experiments on the NSL-KDD benchmark show that the proposed cost-sensitive configuration improves rare attack recognition, most notably increasing U2R recall from 0.00% to 35.82% (24 of 67 test instances) for the stacking ensemble; this improvement, together with the accompanying weighted F1-score change from 0.7120 to 0.7214, is statistically significant under the Wilcoxon signed-rank test across repeated random seeds, and both values are reported with their variability rather than as single point estimates. SVM obtains the largest global gain, with a 7.06 percentage point improvement in weighted F1-score. The results show that cost-sensitive learning is a simple and practical mechanism for improving rare-attack visibility, but also reveal a remaining limitation for R2L detection, where feature overlap with Normal traffic remains substantial. The revised validation design explicitly includes direct resampling baselines, repeated-seed evaluation, statistical significance testing, feature-subset sensitivity analysis, and absolute true-positive counts for R2L and U2R in order to avoid overinterpreting marginal point-estimate gains. All experiments, including the resampling comparison, the component ablation, the feature-subset sensitivity analysis and the repeated-seed statistical evaluation, are executed on the complete KDDTrain+ training set of 125,973 instances under a single unified protocol, so that every reported per-class value refers to the same experimental setting. The revised study additionally reports probability-level evaluation for the primary model, including class-level PR-AUC, precision-recall curves and a U2R threshold and alert-budget analysis, and validates the framework externally on the UNSW-NB15 benchmark, where balanced class weighting raises the recall of the rarest categories (Worms, Shellcode, Backdoor) from near-zero baseline levels to 69–96% under an identical protocol.
I. C. Sălișteanu, I. Udroiu, A. Gheorghe et al.· Electronics· 0 citations
DoS attack and intrusion prediction is essential for IoT networks because it guarantees service availability, and preserves reputation by reducing expensive downtime. Benign, infiltration traffic, DoS golden eye, hulk, slowloris, and slow http test classes were all not taken at the same time with high accuracy in earlier studies on DoS attack and intrusion detection. This research presents a stacking augmented explainable machine learning method for predicting multiclass DoS assaults and network intrusions. The relevant dataset was gathered from the Kaggle source and verified by cyber specialists. Chi-square, RFE, and mutual information are used in feature selection along with SMOTE-based data balance and preprocessing. SHAP is utilized for model explain ability, while grid search CV is used for hyper parameter tweaking. The best DoS attack and intrusion prediction model selection is examined using RF, XGBoost, catboost, LGBM, LR, and ensemble stacking technique (RF, XGB, LR). The stacking enriched ensemble strategy is chosen as the best prediction model in this paper with an accuracy of 97.953 percent. The accuracy of the suggested method is more than 1.75 percent higher than that of previous studies.
Maimuna Tabassum, Umme Saima Tonny, Sabila Anzum et al.· International Conference on...· 0 citations
Intrusion Detection Systems (IDS) are essential for protecting modern networks against unauthorized access and evolving cyber threats. A persistent challenge in IDS design is the high dimensionality of network traffic data, which complicates the identification of the most relevant features for effective detection. This study introduces a modified multi-stage ensemble feature selection (MMSE-FS) framework that incorporates algorithmic adaptations of Random Forest (RF), Principal Component Analysis (PCA), and KBest methods. These enhanced variants are integrated through an intelligent ensemble voting mechanism, followed by a refinement stage that further strengthens feature relevance and discriminative capability.
To validate the proposed framework, experiments were conducted on the UNSW-NB15 benchmark dataset, reducing 49 initial features to 18 critical ones. The dataset was partitioned into 70% training and 30% testing subsets, and classification performance was evaluated using five machine learning classifiers (DT, RF, GB, KNN, and LR). Key hyperparameters of the proposed MMSE-FS framework (α = 0.75, λ = 1.0, and B = 50 bootstrap repetitions) were determined through 5-fold cross-validation on the training partition and subsequently fixed for all experiments. The proposed framework achieved detection accuracies ranging from 99.03% to 99.83% for binary classification and from 94.20% to 96.60% for multi-class classification.
Compared with conventional feature selection methods, the proposed MMSE-FS framework substantially reduced the feature space while maintaining high detection performance across both binary and multi-class intrusion detection tasks. The reported results were obtained using the UNSW-NB15 dataset following the adopted preprocessing strategy, which excluded extremely underrepresented attack classes.
Faruq A. Al-Omari, Alaa Y. Mhesin, Mohammad M. Al-Shurman· International Journal of Wir...· 0 citations
Intrusion Detection Systems (IDSs) play a vital role in safeguarding modern network infrastructures against increasingly sophisticated cyber threats. However, the high dimensionality of network traffic data and the presence of imbalanced attack classes often limit the effectiveness of conventional Machine Learning (ML) approaches. This study proposes a feature-driven Intrusion Detection (ID) framework that combines XGBoost-based feature selection with multiple ML classifiers to improve attack detection performance while reducing computational complexity. The NSL-KDD dataset is utilized to evaluate the proposed approach across five traffic classes: Benign, Denial of Service (DoS), Probe, Remote-to-Local (R2L), and User-to-Root (U2R). XGBoost feature ranking is employed to identify thirteen highly relevant features for each attack category, thereby reducing data dimensionality and eliminating redundant attributes. The selected features are subsequently evaluated using six ML classifiers, namely LightGBM, Voting Classifier, CatBoost, Multi-Layer Perceptron (MLP), AdaBoost, and Stochastic Gradient Descent (SGD). Performance assessment is conducted using Precision, Recall, F1-Score, confusion matrices, and cross-validation analysis. Experimental results demonstrate that ensemble-based models, particularly CatBoost and LightGBM, achieve superior performance for majority attack classes such as DoS and Probe, while all classifiers exhibit challenges in detecting minority classes such as R2L and U2R due to severe class imbalance. Cross-validation results confirm the robustness and stability of the selected feature subsets across different attack categories. Furthermore, a computational complexity analysis highlights the suitability of the proposed framework for practical and resource-constrained ID environments. The findings emphasize the effectiveness of feature optimization in enhancing classification performance and provide valuable insights for the development of efficient and scalable IDS solutions.
Aman Jyoti, Maninder Singh, V. Banga et al.· Scientific Reports· 0 citations
An explainable machine learning framework for network intrusion detection using the CICIDS2017 dataset is proposed, which improves detection accuracy, reduces false positives, and supports informed decision-making, thereby enhancing the transparency, trustworthiness, and practical applicability of intrusion detection systems.
Moa’ath Sa’ad Al-A’athal, Q. A. Al-Haija· Recent Progress in Science a...· 0 citations
With the proliferation of internet-connected infrastructures and the complexity of cyberattacks, cybersecurity and intelligent intrusion detection systems have become more and more critical. Intrusion detection datasets, however, are now highly imbalanced, and conventional machine learning models have become biased towards the majority of benign traffic, misclassifying minority attack classes. This paper introduces a Cost-Sensitive Forest (CS-Forest) approach to enhance the detection of minority attacks in the CSE-CIC-IDS2018 dataset. The proposed framework combines cost-sensitive learning, ensemble-based Random Forest classification, feature selection, and SHAP explainability analysis to boost the performance of intrusion detection and interpretability. Various machine learning algorithms such as Decision Tree, Random Forest, AdaBoost, and XGBoost were tested and compared based on accuracy, precision, recall, F1-score, ROC-AUC, false positive rate, and false negative rate. Experimental results proved that the proposed CS-Forest has excellent performance, with 99.81% accuracy, 99.55% recall, 99.61% F1-score, and 0.998 ROC-AUC, significantly enhancing the performance of minority attack detection and reduced false negatives. The framework learned meaningful and interpretable network traffic behaviors, which was also confirmed using SHAP analysis. The research suggests that future IDS systems should incorporate cost-sensitive learning and explainable AI techniques to ensure improved reliability, transparency, and deployment in the cybersecurity landscape.
Muhammad Binsawad· Electronics· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
