AI-Based Network Intrusion Detection System Using Machine Learning and Explainable AI

Network intrusion detection is an important cybersecurity function because network traffic can contain benign activity as well as malicious behavior. This paper presents an AI-based Network Intrusion Detection System (AI-NIDS) that combines live packet capture, flow generation, machine-learning classification, explainable artificial intelligence, and web-based visualization. The prototype is implemented in an Ubuntu virtual machine hosted through VirtualBox. Scapy captures traffic visible on the virtual network interface, and related packets are grouped into flows. Four features that can be derived directly from live traffic—destination port, packet count, total bytes, and average packet size—are used by the live classification pipeline. CICIDS2017 is used for model training and evaluation. Isolation Forest is used for anomaly-oriented analysis, while Random Forest and XGBoost perform multi-class classification. SHAP provides feature-level explanations, and a Flask dashboard presents live flows, detections, and explanations. On a held-out test set of 22,339 samples, Random Forest achieved 90.67% accuracy and XGBoost achieved 94.42% accuracy; macro F1 scores were 0.78 and 0.81, respectively. The results demonstrate the feasibility of combining machine learning and explainability in a practical NIDS prototype, while highlighting limitations related to reduced live features, rare attack classes, false positives, and virtualized network scope.