An explainable hybrid deep learning framework for binary intrusion detection with 5-fold stratified cross-validation

The increasing complexity and frequency of cyberattacks have made accurate and reliable intrusion detection systems (IDSs) essential for modern network security. In this study, an explainable triple-hybrid deep learning framework is proposed for binary intrusion detection using the CICIDS2017 dataset. The proposed architecture integrates three complementary branches, namely a Transformer encoder, a bidirectional long short-term memory (BiLSTM) network, and a multilayer perceptron (MLP), to capture global feature interactions, sequential dependencies, and nonlinear discriminative patterns from network traffic data. To enhance adaptive representation learning, the framework employs a branch-gating mechanism and a fusion-gating module before final classification. The model was evaluated in a Benign-versus-Attack setting using 5-fold stratified cross-validation and assessed through accuracy, precision, recall, F1-score, ROC-AUC, confusion matrices, and explainability analysis. Experimental results showed strong and stable performance across folds, with a mean validation accuracy of 97.18%, a best-fold accuracy of 97.43%, and a mean ROC-AUC of 0.9975. LIME-based explanations further improved transparency, confirming the framework as an effective and interpretable solution for binary intrusion detection.