Explainable Deep Intrusion Analytics Using Multi-Layer Perceptron and Feature Attribution Techniques

Abstract

The rapid growth of cyber threats has increased the demand for intelligent and reliable Intrusion Detection Systems (IDS) capable of identifying malicious network activities. Although deep learning techniques achieve high detection accuracy, their complex decisionmaking process often lacks transparency, making it difficult for cybersecurity professionals to interpret the results. To address this issue, this study presents an explainable deep intrusion analytics framework using a Multi-Layer Perceptron (MLP) combined with feature attribution techniques. The framework utilizes the CIC-IDS dataset to classify network traffic into normal and attack categories after performing data preprocessing and feature selection. The MLP model is evaluated using performance metrics such as accuracy, precision, recall, F1-score, confusion matrix, and ROC curve to assess its effectiveness in intrusion detection. To improve model interpretability, LIME and SHAP are employed to explain prediction outcomes and identify the most influential features contributing to each decision. A user-friendly application is developed to support dataset upload, preprocessing, model training, performance evaluation, and explanation generation. Experimental results demonstrate that the proposed framework achieves accurate intrusion detection while providing meaningful explanations, making it a trustworthy and practical solution for modern cybersecurity applications.