Explainable Deep Learning for Digital Forensic Evidence Generation: A SHAP-Based Approach for Network Intrusion Attribution

The rapid evolution of cyber threats has intensified the demand for intelligent network forensic systems capable of detecting, attributing, and explaining malicious network activities. Though deep learning models have achieved superior performance in intrusion detection and network forensic analysis, adoption in legal and investigative contexts remains limited due to their “black-box” nature. Courts, forensic analysts, and cybersecurity investigators require transparent, interpretable, and legally admissible evidence capable of explaining how and why a network event was classified as malicious. This paper presents an Explainable Deep Learning-based Digital Forensic Evidence Generation Framework using SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) for network intrusion attribution. The proposed framework integrates Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) architectures with explainable artificial intelligence mechanisms to provide human-readable forensic evidence-based chains and forensic timeline reconstruction. The model was evaluated using the CIC-IoT-2023 and UNSW-NB15 datasets. Experimental results demonstrated high detection accuracy 98.4%, precision of 98.1%, recall 0f 98.3%, and F1-score of 98.2% while simultaneously generating transparent forensic interpretations that improve trustworthiness, legal admissibility, and investigative usability. The study contributes a novel forensic intelligence architecture that bridges the gap between deep learning intrusion detection and explainable digital evidence generation. The proposed framework provides a significant advancement toward legally defensible AI-driven cyber forensic investigations. Keywords: Explainable Artificial Intelligence, Digital Forensics, Deep Learning, Network Intrusion Detection, Cybersecurity, Forensic Timeline Reconstruction. Title: Explainable Deep Learning for Digital Forensic Evidence Generation: A SHAP-Based Approach for Network Intrusion Attribution Author: Olarinde O.O., Adewale O.S., Agbonifo O.C., Adetolaju O.S. International Journal of Novel Research in Computer Science and Software Engineering ISSN 2394-7314 Vol. 13, Issue 2, May 2026 - August 2026 Page No: 1-8 Novelty Journals Website: www.noveltyjournals.com Published Date: 26-May-2026 DOI: https://doi.org/10.5281/zenodo.20395475 Paper Download Link (Source) https://www.noveltyjournals.com/upload/paper/Explainable%20Deep%20Learning%20for%20Digital-26052026-5.pdf