Intrusion Detection 2.0: Revisiting Benchmark Workflows with Explainable and Tuned AI Models

Intelligent Transportation Systems (ITS) and smart mobility/logistics ecosystems rely on heterogeneous, safety-critical networks that span information technology and operational technology domains across connected vehicles, mobility infrastructure, and supply-chain systems, making intrusion detection essential. However, many AI-driven IDS benchmarks overfit specific datasets and offer limited interpretability for operational use. This study reproduces the AI-driven IDS workflow of Al-Doori and Alheeti Al-Doori et al. (2025) and adapts it toward transportation cybersecurity by emphasizing reproducible preprocessing, tuned models, imbalance handling, and explainability. The pipeline is evaluated on KDD Cup’99 (10%) and CIC-IDS2017 using one-hot encoding and z-score normalization, comparing CatBoost, LightGBM, XGBoost, and TabNet against a compact DNN with Optuna tuning and class-imbalance mitigation (class weights; SMOTE for analysis). CatBoost achieves 99.9% accuracy with macro-F1 ≈0.94 on KDD’99 and ∼0.99 accuracy with macro-F1 ≈0.92 on CIC-IDS2017, where rare attacks remain the main source of errors. SHAP explanations confirm that traffic volume, connection-rate, and flow-timing features drive predictions, supporting interpretable triage for ITS operators. Code, splits, and hyperparameters are released for reproducibility.