Explainable Network Intrusion Detection Using Random Forest and SHAP on the CICIDS2017 Dataset

Network intrusion detection plays a vital role in protecting modern computer networks and IoT environments from cyber threats. Traditional machine learning approaches often focus on improving detection accuracy without providing insight into decision-making processes. This paper proposes an explainable intrusion detection framework using a Random Forest classifier trained on the CICIDS2017 dataset. The dataset includes realistic benign and malicious network traffic, enabling effective model evaluation. The proposed model achieves an accuracy of 92% in distinguishing benign and attack traffic. To enhance transparency and interpretability, SHAP (SHapley Additive exPlanations) is employed to analyze feature contributions influencing predictions. Experimental results demonstrate that flow-based and packet-level features significantly impact attack detection. The integration of explainable AI improves trust and usability of machine learning-based intrusion detection systems in real-world cyber security applications.