Human-Centered Explainable AI for Security Enhancement: A Deep Intrusion Detection Framework

TL;DR

This paper introduces a deep learning-based intrusion detection framework that combines CNN and LSTM models with explainability via SHAP, achieving high accuracy and interpretability for cybersecurity applications.

Contribution

The paper presents a novel, interpretable IDS framework integrating XAI with deep learning, evaluated on NSL-KDD, improving transparency and performance over traditional methods.

Findings

Both CNN and LSTM achieved 0.99 accuracy.

LSTM outperformed CNN in macro average precision, recall, F-1 score.

SHAP provided insights into influential features for model decisions.

Abstract

The increasing complexity and frequency of cyber-threats demand intrusion detection systems (IDS) that are not only accurate but also interpretable. This paper presented a novel IDS framework that integrated Explainable Artificial Intelligence (XAI) to enhance transparency in deep learning models. The framework was evaluated experimentally using the benchmark dataset NSL-KDD, demonstrating superior performance compared to traditional IDS and black-box deep learning models. The proposed approach combined Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) networks for capturing temporal dependencies in traffic sequences. Our deep learning results showed that both CNN and LSTM reached 0.99 for accuracy, whereas LSTM outperformed CNN at macro average precision, recall, and F-1 score. For weighted average precision, recall, and F-1 score, both models scored almost similarly. To ensure interpretability, the XAI model SHapley Additive exPlanations (SHAP) was incorporated, enabling security analysts to understand and validate model decisions. Some notable influential features were srv_serror_rate, dst_host_srv_serror_rate, and serror_rate for both models, as pointed out by SHAP. We also conducted a trust-focused expert survey based on IPIP6 and Big Five personality traits via an interactive UI to evaluate the system's reliability and usability. This work highlighted the potential of combining performance and transparency in cybersecurity solutions and recommends future enhancements through adaptive learning for real-time threat detection.