On the one hand, the widespread adoption of networked systems, cloud-based services, and Internet of Things (IoT) infrastructure has expanded attack surfaces. A large number of threat vectors now confront contemporary organizations, including distributed denial-of-service (DDoS) attacks, malware spread, port scanning, and brute-force intrusions, which could pose serious risks to the confidentiality, integrity, and availability (CIA) of digital assets. Conventional intrusion detection systems (IDSs) that chiefly use signature- or rule-based methods face challenges in detecting new or evolving attack patterns and may generate a large number of false alarms in complex network environments [1,2]. To mitigate these drawbacks, the data-driven intrusion detection system based on machine learning (ML) has attracted significant attention. By being trained on network traffic data, ML-based IDSs can generalize beyond predefined rules and detect previously unseen attacks. Yet, while achieving impressive performance, many ML techniques function as black boxes, yielding predictions but no explanation of how they were obtained. This lack of interpretability decreases trust in automated detection systems and thus prevents their use in real-world SOCs, where explanation is vital for incident response and decision-making [3].

Current research has focused on machine learning/deep learning models of ID, using benchmark datasets such as KDD99, NSL-KDD, UNSW-NB15, and CICIDS2017 [4,5,6]. Although the reported classification accuracy is high in these works, most emphasize performance improvement, and interpretability is neglected in the detection model. As a consequence, analysts may lack insight into why a model made certain decisions, which would prevent them from validating alerts, investigating attacks, or informing defensive strategies. More recent work has underscored the value of explainable artificial intelligence (XAI) for security, especially in intrusion detection [7,8]. However, the application of explainability approaches to IDS pipelines remains limited, and many existing studies employ XAI only as a post-hoc explanatory tool rather than integrating explainability into the intrusion detection workflow to support analyst decision-making or fail to turn explanations into actionable security items. There is a clear gap for a systematic approach that unifies high-performing ML-based intrusion detection with strong, generalizable feature-level explanations of real network traffic data.

Given a labeled network traffic dataset that contains benign and malicious flows, the intrusion detection problem can be framed as a supervised classification task. Let

be used to represent network flow feature vectors and

represent their class labels so that each label will suggest benign traffic or one of the attack categories. We aim to learn a classification function f: X → Y that, with high accuracy, identifies malicious behaviors from benign activities while minimizing false alarms. In addition to accurate label prediction, we also need to provide interpretable explanations for this model’s predictions. In other words, the model should recognize which realizations contribute to a certain network flow, xi, and understand how each feature’s contribution affects the output. This allows security practitioners to learn about attack properties, validate alerts, and gain insights into network behavior.

This work offers the following three main contributions:

An Intrusion Detection System (IDS) is a security system that monitors network or system activities and detects potential security violations. IDS solutions are divided into host-based (HIDS) and network-based (NIDS). HIDSs monitor activities at the host level, for example, system calls and log files, while NIDSs analyze network traffic to identify anomalous behavior in communication flows [9]. According to the detection technique, IDS approaches are typically classified into signature-based or anomaly-based. Signature-based IDS relies on attack signatures for detection and effectively protects only against known attacks, but cannot detect zero-day or unknown attacks. In contrast, anomaly-based IDSs learn normal behavioral patterns and identify deviations as potential intrusions, building a profile of normal behavior and alarming deviations as potential intrusions, providing greater detection of new attacks at the expense of false positives [10]. With the growth of network traffic in both volume and variety, anomaly-based or hybrid methods are more appropriate for today’s environment.

Machine learning has also played a key role in the development of data-driven intrusion detection systems, enabling them to learn complex patterns from large datasets. Supervised learning techniques, including Logistic Regression, Support Vector Machines (SVMs), Decision Trees, Random Forests, and Gradient Boosting models, are popular and have been used for categorizing network traffic as normal or attack traffic [11,12]. These models leverage both statistical and structural attributes derived from network traffic flows, such as packet sizes, durations, byte counts, and protocol data. Ensemble learning techniques (e.g., Random Forests and XGBoost) are popular in IDS, as they incorporate multiple weak learners to enhance generalization and tolerance to noise or imbalance. Deep learning-based models such as multilayer perceptrons (MLPs), convolutional neural networks (CNNs), and recurrent neural networks (RNNs) have achieved superior performance in intrusion detection. Still, they usually require considerable computational power and abundant labeled data [13]. Despite its efficacy, ML-driven IDS faces issues of class imbalance, concept drift, and explainability. High detection accuracy is insufficient in operational settings, where security analysts need to understand and be confident in automated decisions before acting.

The CICIDS2017 dataset, created by the Canadian Institute for Cybersecurity, is commonly used to benchmark intrusion detection systems. It includes realistic network traffic spanning several days, with non-malicious user behavior and a broad range of attack types, such as brute-force, DoS/DDoS, port scans, botnet activity, and web-based attacks [6]. The dataset contains flow-wise features generated with the CICFlowMeter extraction tool and includes over 80 statistical attributes for each network flow. These characteristics capture different dimensions of traffic behavior, such as flow duration, packet burstiness, inter-arrival times, and header fields. An additional benefit is that CICIDS2017 is a highly preferred dataset among researchers for academic research, as the recordings help simulate realistic traffic, include labeled and categorized attack types, and are more adaptable for supervised machine learning-based studies.

Explainable Artificial Intelligence (XAI) is a set of methods designed to ensure that predictions made by machine learning models are human-understandable. Explainability is crucial in cybersecurity to verify alerts, aid post-mortem analysis, and enforce accountability in automated decision-making systems [14]. Without interpretability, an ML-based IDS may produce accurate predictions that analysts cannot interpret or trust. A popular family of XAI techniques is the Shapley Additive exPlanations (SHAP), which has its roots in cooperative game theory. SHAP assigns each feature a contribution value that reflects its influence in predicting a single counterfactual example relative to a baseline [15]. SHAP can provide explanations at both the global level, attributing features’ overall importance across the dataset, and the local level, explaining specific predictions. It is therefore well-suited for intrusion detection, in which both general attack patterns and specific incidents are of interest. Security practitioners can therefore leverage XAI methods, such as SHAP, once integrated into IDS pipelines, to move beyond black-box predictions and better understand the behaviors inherent to cyberattacks.

Comparison studies have shown that traditional ML techniques, such as Random Forest (RF), Gradient Boosting, and XGBoost, achieve state-of-the-art accuracy for NID when trained on authorized traffic datasets, such as CICIDS2017. In a recent benchmark, ten ML algorithms were evaluated on the CICIDS2017 dataset, showing the near-perfect (e.g., 99% TPR and FPR) detection of several ensemble models (i.e., XGBoost, Random Forest), but highlighting the need for further improvement in both hyperparameter and class-imbalance management techniques for both detectors [16]. Moreover, deep learning-based IDS models have also been exploited to capture complex network patterns, as in an enhanced multilayer perceptron (MLP) that employs detection of minority attack classes at a high computational cost [17].

While high classification accuracy is important, many ML models are black boxes, making it difficult for security analysts to explain the alerts they receive at runtime. Addressing this challenge, XAI is integrated into IDS frameworks in several recent studies:

These studies, as a whole, emphasize the growing importance of explainability, particularly in the context of the use case and the trust analysts place in data-driven IDS.

In addition to straightforward, explainable ML models, other studies show that hybrid and ensemble-based approaches can provide both strong detection and interpretable insights [14,15,16].

Despite the considerable progress that has been achieved, there are still gaps identified by existing research, which this work specifically aims to fill:

This project will close these gaps by systematically benchmarking explainable ML models on the CICIDS2017 dataset, with not only quantitative performance comparisons but also qualitative interpretability analyses that enable actionable security insights.

This work uses the CICIDS2017 dataset, generated by the Canadian Institute for Cybersecurity (CIC), and is considered one of the most complete and realistic intrusion detection datasets. The dataset contains network traffic collected over five consecutive days, including both legitimate user activities and a wide range of attacks that mimic realistic network intrusions. These are Brute Force, Botnet, DoS/DDoS traffic, Port Scanning (Nmap & Hping3), Web, and Infiltration attacks [6]. Traffic was generated using actual user profiles, including HTTP, HTTPS, FTP, and SSH, as well as email services. Flow-based characteristics were computed by the CICFlowMeter tool that generated more than 80 statistical features per flow, which included:

Each network flow is labeled as one of the attack types or “BENIGN”. The dataset is also well-suited for supervised attack detection because it has rich labels and a variety of attack types. Our study utilized the CICIDS2017 dataset released by the Canadian Institute for Cybersecurity (CIC), which contains network traffic collected over five consecutive days and includes both benign and malicious activities. The dataset comprises multiple attack categories, including Brute Force, DoS/DDoS, Botnet, PortScan, Web Attacks, and Infiltration attacks. The proposed framework relies on flow-based features generated by CICFlowMeter and does not utilize packet payload contents or host-level security telemetry. Consequently, the analysis is limited to behavioral characteristics observable at the network-flow level.

Data preprocessing involved removing invalid records, handling missing and infinite values, encoding categorical attributes, selecting features, and mitigating class imbalance. Records containing corrupted, missing, or non-numeric feature values were cleaned before model training. The final processed dataset was then partitioned into training, validation, and testing subsets for model development and evaluation.

(1) Data Cleaning

(2) Feature Selection: Although CICIDS2017 offers 80+ features, many are:

(3) Encoding Categorical Variables: The “Protocol” attribute (TCP, UDP, ICMP) was one-hot encoded to allow ML algorithms to train on protocol groups without assuming an inherent order within them.

(4) Data Normalization/Standardization: Machine learning models are scale-sensitive. Two normalization strategies were evaluated:

(5) Handling Class Imbalance: Class imbalance was mitigated using:

(6) Dataset Splitting: The dataset was split into 70% training, 15% validation, and 15% testing. Split on class labels to control the attack proportion between splits.

The proposed IDS adopts a modular, data-driven structure comprising five primary stages: Data Processing, Preprocessing & Feature Engineering, Model Training & Baseline Comparisons, Explainability Analysis using SHAP, Evaluation & Security Interpretation. A conceptual diagram of the system workflow is described below:

Feature engineering is a key to improving model performance and interpretability. The following strategies were used:

(1) Feature Extraction through Statistics: The dataset that comes with CICIDS2017 already includes 80+ flow-based features, but some preprocessing-dependent ones were employed for in-house evaluation, such as:

(2) Feature Selection: Feature selection was conducted to reduce redundancy and improve model interpretability. The process involved removing low-information and highly correlated features, followed by importance-based ranking using tree-based models. This step was performed during model development before final model training and explainability analysis. Feature selection was performed in two stages to prevent overfitting and enhance the interpretability:

Several baseline and state-of-the-art supervised machine learning algorithms were selected for comparison. These models can be divided into three categories:

(1) Baseline Models: These baselines are critical for new performance models.

(2) Ensemble Learning Models: Ensemble models were selected as they are stable, have nonlinear decision boundaries, and perform well in high-dimensional security datasets: Random Forest (RF) and XGBoost Gradient Boosting (XGB). We choose XGBoost as our high-performance model because of its well-demonstrated success in the network intrusion detection literature [1].

(3) Deep Learning Model: A Multilayer Perceptron (MLP) with:

We add this model to compare classical ML with neural models.

(1) Train–Validation–Test Structure: The dataset was divided into 70% for training, 15% for validation, and 15% for evaluation, with stratified label distribution.

(2) Hyperparameter Optimization: A combination of:

was employed to optimize parameters such as:

All models were optimized on the validation set to prevent overfitting.

Explanation is a key component of this project. SHapley Additive exPlanations (SHAP) was introduced into the pipeline to explain model outputs.

(1) Global Explainability: SHAP was used to compute:

(2) Local Explainability: For specific flows (e.g., misclassifications):

Security-related patterns to which SHAP findings were applied. Beyond ML interpretation, we mapped SHAP findings to the following security-related:

All experiments were written in the Python scientific computing stack. The following tools and libraries were utilized:

All implementations were done in Jupyter Notebook to facilitate experimentation and demonstration of results.

The models were trained and evaluated on the following hardware configuration:

The main machine learning models (Random Forest, XGBoost) were efficiently computed on the CPU, and deep learning experiments were sped up by running them on a GPU.

To make comparisons, the following baseline models were established:

These are benchmark models that provide a baseline for comparing improvements obtained with better models.

We selected two principal groups of advanced models:

(1) Ensemble Models

Ensemble techniques are chosen because they have historically performed well in network intrusion detection benchmarks.

(2) Deep Learning Model (Optional)

(1) Dataset Splitting

The CICIDS2017 dataset was divided into 70–15–15 in a stratified fashion to keep the class imbalance properties in each set:

The CICIDS2017 dataset was partitioned using a stratified random split (70% training, 15% validation, and 15% testing) to preserve the class distribution across all subsets. No day-based partitioning was employed in the current study.

(2) Hyperparameter Tuning

Hyperparameter optimization was performed using Grid Search for conventional machine learning models and Random Search for more computationally demanding models. The tuning process used the validation set to reduce overfitting and improve model generalization. Model hyperparameters were tuned using:

Hyperparameters considered include:

(3) Class Imbalance Handling

To address class imbalance, SMOTE was applied exclusively to the training set. The validation and testing sets remained unchanged to ensure an unbiased evaluation of model performance. While SMOTE can improve minority-class representation, synthetic samples may not fully capture the complexity of real network traffic patterns. Specifically, for balanced learning on the attack classes with a small number of records:

Because we had limited computational power, we capped the maximum number of samples per class at 15,000. We had to perform undersampling on classes with more than 15,000 records. No resampling was performed on the validation and test sets to avoid bias. Also, to prevent data leakage, all preprocessing operations, including feature selection, normalization, and SMOTE oversampling, were performed exclusively on the training set. The validation and testing sets remained isolated throughout model development and hyperparameter tuning.

The classification performance was evaluated using the following metrics:

For class-wise analysis, the confusion matrix. These measures demonstrate the trade-offs between false positives and false negatives required in intrusion detection.

(1) SHAP Configuration

SHAP values were calculated for the best model (often XGBoost):

(2) Visualization Outputs

The following are the SHAP plots that were generated:

These visualizations form the basis for later security interpretation.

To ensure reproducibility:

Table 1 summarizes the performance of all baseline and advanced models on the test set using standard evaluation metrics.

Key Observations:

Confusion matrices indicate that:

Notable Misclassification Patterns:

These findings underscore the need to address class imbalance and ensure that rare attack forms are properly accounted for. A more detailed per-class performance analysis, including class-wise precision, recall, and F1-score reporting, is considered an important direction for future work.

ROC curves show:

Although SHAP provides valuable model interpretability, generating explanations for large-scale datasets may introduce additional computational overhead compared with standard prediction pipelines. Similarly, deep learning models generally require greater computational resources for training and inference than traditional machine learning approaches. Therefore, practical deployment should consider the trade-off between explainability, detection performance, and computational efficiency. SHAP analysis was mostly performed based on the best-performing model (XGBoost).

(1) Feature Global Importance: Global summary plots based on SHAP values showed that the key features for all attacks are:

These attributes closely resemble the well-known behavioral profiles of current network attacks.

Interpretation:

(2) Local Explanations: SHAP force plots of misclassified samples indicated:

Such local explanations help analysts understand why false positives and false negatives occur.

Explainability helps associate model predictions with underlying traffic characteristics, providing additional context that may assist security analysts in understanding detected attack behaviors.

To demonstrate the operational value of explainability, we analyzed representative intrusion alerts generated by the XGBoost model. For example, flows labeled PortScan consistently showed large SHAP values for SYN Flag Count and small Flow Duration, allowing analysts to quickly associate the alert with reconnaissance activity rather than benign network behavior. Similarly, most DDoS alerts were triggered by increased values of Flow Packets/s and Packet Length Variance. These explanations provide interpretable evidence to support model decisions and can help analysts with alert validation, investigation prioritization, and reducing time spent interpreting black-box predictions. While a formal user study was beyond the scope of this work, these results demonstrate how SHAP-based explanations can help bridge the gap between machine learning outputs and analyst reasoning in operational security environments.

While SHAP provides valuable insights into model behavior and enhances the interpretability of intrusion alerts, generating explanations introduces additional computational overhead compared with standard prediction pipelines. Therefore, practical deployment requires balancing the benefits of improved analyst understanding and trust against the associated computational cost. Evaluating this trade-off in terms of processing time, resource utilization, and operational security value remains an important topic for future industrial-scale studies. The interpretations presented in this study are derived from flow-level network characteristics. While these features provide valuable information for attack detection, additional context from packet payloads, DNS activity, authentication logs, and host-based telemetry could further enrich security analysis and improve detection capabilities. Besides, while flow-level features provide valuable indicators of attack behavior, combining them with additional security telemetry, including DNS activity and host-based events, could enhance contextual awareness and improve the distinction between malicious actions and legitimate user activities.

Despite applying SMOTE, minority attack classes, such as Infiltration, remained more difficult to classify than major attack categories. This behavior is likely attributable to the limited number of representative samples and the subtle statistical characteristics of these attacks, which make them less distinguishable from benign traffic. These findings highlight the ongoing challenges posed by imbalanced intrusion detection datasets.

False Positives: Mostly associated with:

False Negatives: Primarily occurred in:

Some extra data collection or feature augmentation could mitigate those mistakes.

In this paper, we propose a data-driven intrusion detection framework that combines machine learning and explanation technologies to improve the interpretation of malicious network traffic. Based on the CICIDS2017 dataset, we compared several baselines and found that XGBoost achieved superior performance across accuracy, precision, recall, F1-score, and ROC-AUC. The results showed that ensemble methods could better capture nonlinear and complex attack behaviors than traditional machine learning models and deep learning baselines. One important contribution of this work is the adoption of SHAP to make model outputs transparent and interpretable. Explainability analysis identified salient network flow–based features influencing detection decisions and derived explicit behaviors for DDoS, PortScan, and Botnet activities. These findings represent a step forward in translating raw statistical detection scores into actionable intelligence for security analysts and in rendering the system more appropriate for operational use in SOCs. In general, the results show that integrating robust explainability with high-performing machine learning models improves the effectiveness and trust of IDS. This combined approach improves both detection effectiveness and interpretability, making the framework more suitable for practical cybersecurity applications.

Future work will investigate temporal and day-based evaluation strategies to better assess model robustness and generalization under realistic network deployment scenarios. Besides, although promising, the following two issues still need to be better implemented: