Explainable AI-Based Intrusion Detection for Identifying Unknown Cyberattacks in Enterprise Networks

Enterprise networks face increasingly sophisticated cyberattacks that evade conventional signature-based detection and exploit previously unseen vulnerabilities, unfamiliar traffic patterns, and evolving adversarial techniques. Artificial intelligence-based intrusion detection systems improve anomaly recognition but often lack the transparency required for reliable security operations and incident investigation. This paper proposes an explainable artificial intelligence framework that integrates anomaly detection, supervised traffic classification, open-set recognition, and feature-attribution techniques to identify potentially unknown cyberattacks. The framework combines statistical deviation analysis with deep representation learning and employs SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME) to generate global and instance-level explanations. A rigorous evaluation methodology is developed using attack-family holdout, class-imbalance analysis, detection metrics, explanation fidelity, and computational overhead. The proposed framework aims to improve unknown-threat identification, analyst interpretability, and operational reliability while addressing false alarms, adversarial manipulation, and dataset generalization limitations in enterprise security environments.