build explainable intrusion detection

This work addresses the limited interpretability of alerts generated by existing deep learning–based network intrusion detection systems (NIDS), which hinders effective analyst-driven triage in practice. To bridge this gap, the authors propose EXP-SEC, a novel framework that incorporates a forensic module to pinpoint suspicious traffic and introduces a fine-grained explanation mechanism capable of handling feature overlap and group-wise dependencies. By leveraging a multi-stage mapping strategy, EXP-SEC translates model predictions into semantically meaningful alerts aligned with the domain knowledge of security operations centers. This framework is the first to deliver domain-aligned explanations tailored for security analysts, significantly outperforming xNIDS in group-level and overlap-aware explanatory utility while maintaining comparable performance in accuracy, sparsity, and stability. The resulting explanations are more intuitive and actionable for human analysts.

Existing explainable intrusion detection systems (X-IDS) lack rigorous, semantics-aware metrics for evaluating explanation quality. Method: This paper proposes a domain-knowledge-driven feature alignment metric that quantifies the consistency between X-IDS explanations and a predefined cybersecurity semantic feature set, by explicitly modeling domain-specific prior knowledge and mapping explanations onto this structured knowledge base. Contribution/Results: It is the first work to establish domain-informed semantic alignment as a core evaluation principle in XAI for IDS—moving beyond conventional fidelity- and simplicity-based assessment. Experiments across multiple X-IDS models and representative attack scenarios demonstrate that the metric effectively discriminates explanation quality, enabling security analysts to reliably assess explanation trustworthiness and guide targeted model refinement. The approach significantly enhances the interpretability and operational utility of X-IDS in real-world deployment.

To address the limited interpretability of Network Intrusion Detection Systems (NIDS), this paper proposes an LLM-based explainable NIDS framework. The core innovation is the Prompt Augmenter module, which dynamically integrates network flow context with multi-source threat intelligence to generate structured, semantically rich detection explanations. Evaluated on Llama-3 and GPT-4, the method improves explanation correctness and consistency by over 20% compared to baseline prompting. Leveraging natural language inference and custom evaluation metrics, it enables quantitative assessment of explanation quality. Experimental results demonstrate that the augmented prompting strategy significantly outperforms context-agnostic baselines across accuracy, consistency, and readability—achieving substantial gains in all three dimensions. This work establishes a novel paradigm for enhancing cybersecurity interpretability through LLMs.

To address alert overload in network intrusion detection systems (NIDS) and the limited interpretability of deep learning models, this paper proposes an LSTM-based framework for automated alert prioritization. It conducts the first systematic empirical evaluation of four XAI methods—LIME, SHAP, Integrated Gradients, and DeepLIFT—on real-world Security Operations Center (SOC) alert logs. The study introduces a novel multidimensional XAI evaluation framework assessing fidelity, complexity, robustness, and reliability. Experimental results demonstrate that DeepLIFT consistently achieves superior performance across all metrics. Crucially, its feature attributions align closely with domain-expert security analysts’ judgments, significantly enhancing model trustworthiness and operational utility. This work establishes a reproducible, empirically grounded evaluation paradigm for explainable AI in network threat response, bridging the gap between XAI research and practical cybersecurity deployment.

To address the prevalent black-box nature of machine learning–based intrusion detection systems (IDS), this paper proposes an explainable AI framework integrating LIME (Local Interpretable Model-agnostic Explanations), ELI5 (Explain Like I’m 5), and decision trees—marking the first synergistic application of local instance-level explanations and global feature importance analysis in the IDS domain. Evaluated on the UNSW-NB15 dataset, the framework balances model transparency with detection performance, achieving 85% attack classification accuracy while identifying and ranking the top-10 most influential features for each attack class. The core contribution lies in a lightweight, production-ready hybrid interpretability paradigm that enhances both trustworthiness and operational utility of AI models in cybersecurity applications.

This work addresses the limitations of traditional anomaly detection systems, whose feature-level explanations often lack contextual relevance and actionable insights, thereby hindering efficient alert investigation by security analysts. To overcome this, the paper proposes an event-centric, detector-agnostic explainability framework that uniquely integrates multi-agent collaboration with large language models (LLMs). By orchestrating a structured, hypothesis-driven automated investigation process, the framework generates alert explanations grounded in verifiable evidence. This approach substantially enhances post-hoc analysis efficiency, delivers operationally meaningful interpretations, and significantly improves event classification accuracy.

本文通过设计实验测试机器学习入侵检测系统对未知攻击的泛化能力，揭示了模型在面对未知攻击时的有效性错觉及研究评估方法中的结构弱点。

本文探讨了使用可解释人工智能(XAI)技术解决工业网络安全中因采用AI和机器学习导致的决策不透明问题，综述了XAI方法及其在安全运营中的应用与挑战。

研究通过SuriCap平台和CTF式工作坊，分析了60名参与者创建网络入侵检测规则的过程与方法，揭示经验对规则质量影响有限，并指出标记数据的重要性。

This study addresses the prevailing focus on prediction accuracy in existing IoT intrusion detection research, which often overlooks the computational overhead, stability, and practicality of explanation mechanisms. For the first time, it systematically evaluates binary intrusion detection models under resource-constrained IoT conditions across four dimensions: predictive performance, explanation cost, local stability, and selective explanation strategies. Leveraging a newly constructed leakage-safe dataset with feature hashing and deterministic preprocessing, the authors employ Logistic Regression, Decision Tree, Random Forest, and XGBoost models, generating explanations via TreeSHAP. Experimental results show that XGBoost achieves the best predictive performance, while Random Forest yields the lowest false positive rate and the most stable explanations. The proposed validation-calibrated selective explanation strategy reduces computational overhead by 15–32% on balanced test sets, underscoring the critical importance of multidimensional evaluation for real-world deployment.