An Explainable Deep Learning Framework for Intrusion Detection

This research presents an Explainable Deep Learning framework for Network Intrusion Detection, specifically designed to address the challenges of model transparency and extreme class imbalance. Using the CIC-IDS2017 dataset, the study implements a hybrid CNN-LSTM architecture to capture spatial and temporal feature dependencies in network traffic. Key Contributions: Imbalance Handling: Utilizes a hybrid resampling strategy (SMOTE and Random Undersampling) to significantly boost detection rates for rare attacks. High Performance: Achieved a test accuracy of 95.93% and a weighted F1-score of 0.97. Minority Class Improvement: Successfully increased the recall for the "Infiltration" attack category from 0% to 57%. Explainable AI (XAI): Integrates SHAP (SHapley Additive exPlanations) to provide transparent, feature-level justifications for every prediction, enabling cybersecurity analysts to trust and validate system alerts. This framework bridges the gap between complex black-box deep learning models and the practical need for actionable, interpretable insights in real-world cybersecurity environments.