Evaluating Explainable Hybrid Intrusion Detection Models Under Zero-Day Conditions

Abstract

Zero-day network attacks pose a significant threat because their unknown signatures evade traditional detection mechanisms. This research develops an AI-enhanced intrusion detection system that aims to detect such attacks while providing interpretable outputs for security analysts. Four machine-learning models are evaluated under strict zero-day conditions using two benchmark datasets. SHAP and LIME are applied to produce instance-level explanations, and a formal stability assessment is conducted to determine their reliability. Experimental results show that the hybrid model combining anomaly-based detection with deep learning achieves the highest zero-day Recall, with statistically significant advantages over individual models in detecting previously unseen attacks, while the standalone LSTM achieves the strongest overall balance between Precision and Recall. The generated explanations consistently reveal security-relevant features, and stability analysis confirms their robustness across conditions. The study demonstrates that integrating deep learning with stable explainable AI offers a practical and trustworthy solution for zero-day intrusion detection, contributing validated evidence to an area where explanation reliability is rarely examined.