Explainable Artificial Intelligence for Network Intrusion Detection Using Machine Learning Models

Network intrusion detection systems (NIDS) represent a key component of the modern cybersecurity architecture as they can provide 24/7 monitoring of network traffic in order to determine malicious intent. Over the past few years, machine learning (ML) models have significantly improved the performance of intrusion detection; nevertheless, the majority of them represent opaque models that do not reveal much information about the way the decisions are made. This lack of interpretability undermines trust, as it hinders a forensic analysis, and limitation to its adoption in the context of the actual security operations. In order to address this difficult issue, the current project suggests an elaborated explainable artificial intelligence (XAI)-based framework of intrusion detection, which combines the traditional machinelearning classifiers with the use of the post-hoc explanatory methods. The presented framework uses random forest (RF), support vector machine (SVM), and extreme gradient boosting (XGBoost) as intrusion detection models and makes use of SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) to provide a global and a local level of interpretability. The publicly accessible NSL -KDD benchmark dataset is used to evaluate the system. Experimental findings prove the ability of the proposed method to yield higher detection rates besides providing significant explanations of forecasts. Explainability is added to help increase transparency, assist security analysts in their decision-making process, and enhance trust in intelligent intrusion detection systems.