A comprehensive analysis of explainable AI-driven machine learning techniques for network intrusion detection systems

Explainable Artificial Intelligence (XAI) has emerged as a critical enabler for improving the transparency, trustworthiness, and operational usability of Machine Learning (ML) and Deep Learning (DL)-based Intrusion Detection Systems (IDS). While ML/DL models have significantly advanced detection capabilities, their black-box nature poses challenges for security analysts, regulatory compliance, model debugging, and adversarial robustness. This survey presents a comprehensive review of XAI techniques applied to IDS, with particular emphasis on research published over the past five years. We develop a unified taxonomy of XAI-enabled ML-based IDS methods, categorizing methods based on model transparency, explanation scope, and operational objectives. The survey systematically analyzes IDS frameworks across diverse deployment environments–including cloud, IoT/IIoT/CPS, SDN, and IoMT–and reviews major explanation mechanisms such as SHAP, LIME, attention-based models, saliency methods, and rule-extraction techniques. We consolidate evaluation practices by examining both detection-performance metrics and explanation-quality measures, highlighting their interpretations and limitations in IDS contexts. Furthermore, we investigate XAI-enabled ML-based IDS from an adversarial perspective, identifying vulnerabilities to evasion, mimicry, poisoning, and attacks targeting explanation mechanisms. We also review the dataset landscape, discussing representativeness gaps and generalization challenges. Finally, we identify critical open issues and outline future research directions, including adversarially robust explainability, scalable explanation mechanisms, realistic datasets, deployment-aware design, and human-in-the-loop IDS. This survey aims to provide researchers and practitioners with a structured foundation for designing transparent, robust, and operationally effective XAI-enabled ML-based IDS.