The proliferation of sophisticated network attacks necessitates advanced cyber defense systems that are not only accurate but also transparent. However, many machine learning-based intrusion detection systems operate as 'black boxes,' hindering trust and practical implementation. This paper addresses this gap by presenting an explainable artificial intelligence (XAI) approach for detecting network attacks. We developed and compared three models-Random Forest, XGBoost, and an MLP neural network-finding that the MLP model achieved the highest accuracy of 0.9508, a log loss of 0.0793, and an AUC of 0.9922. To ensure transparency, we integrated XAI methods like LIME for local and Permutation Feature Importance for global explanations, successfully identifying key trafic characteristics that influence model decisions. The proposed approach was validated in a realistic KVM-based laboratory environment, confirming that the synergy of high-accuracy machine learning with XAI provides a robust and trustworthy framework for modern cybersecurity.
The rapid growth in the number of devices connected to the network and the intensity of data transmission leads to an increase in the level of threats in cyberspace. Modern attacks on network infrastructure are characterized by high complexity, multi-vector nature, and the ability to bypass traditional security measures. In these conditions, it is important to improve intrusion detection systems (IDS) and intrusion prevention systems (IPS) that are capable of responding to trafic anomalies in a timely manner.
Traditional cyber security methods based on a signature approach no longer provide suficient protection against modern attacks. This is due to the emergence of new types of threats that rapidly change their characteristics. In addition, the growth in network trafic data volumes creates additional challenges for efective analysis and requires the implementation of more flexible and scalable solutions.
Recent years have seen significant progress in the application of machine learning methods in many
areas. In finance, machine learning is used to improve financial analytics [
The use of classification algorithms and intelligent models improves the accuracy and speed of
identifying abnormal behavior on the network. At the same time, the widespread implementation of
such approaches is accompanied by the “black box” problem, where the results of the model are dificult
to interpret and explain. This limits trust in cybersecurity systems, especially in critical infrastructure,
where decisions must be understandable to experts and comply with regulatory requirements. In
this context, a promising direction for development is the use of Explainable Artificial Intelligence
(XAI) methods [
The problem remains finding methods and models that can combine high attack detection accuracy with minimization of false positives, efective real-time operation, and a high level of interpretability. The developed systems must ensure scalability, adaptability to new types of threats, and the ability to explain their decisions in an understandable way. The main contribution of this work lies in combining machine learning models with Explainable AI methods, which simultaneously improves the accuracy of network attack detection and ensures decision-making transparency in IDS/IPS systems.
Next, the paper is organized as follows. Section 2 provides a review of related work and modern approaches to applying machine learning and Explainable AI in cybersecurity. Section 3 describes the dataset used, the selected machine learning methods, and the Explainable AI techniques. Section 4 presents the modeling results, performance analysis of the models, and interpretation of their decisions. Section 5 summarizes the findings.
The issue of detecting and preventing intrusions into computer networks has attracted the attention of
scientists over the past decades. Machine learning methods have proven to be efective in classifying
network trafic and detecting various types of attacks with high accuracy [
In [
The paper [
The authors in [
Study [
The paper [
The authors in [
The paper [
The study [
The paper [
Study [
The paper [
The study [25] examines new approaches to IDS development, driven by the rapid growth in the number of attacks on network systems. The authors emphasize the need for explainability of artificial intelligence models used in such systems in order to increase the trust and efectiveness of security analysts. A framework for evaluating black-box Explainable AI methods in the context of network IDS is proposed. Both global and local aspects of XAI application, in particular SHAP and LIME methods, are investigated using six metrics. Experiments were conducted on three popular datasets and seven AI models. The results revealed the strengths and weaknesses of XAI methods and provided a basic toolkit for the cybersecurity community.
The paper [26] provides an overview of modern XAI methods in the field of network trafic analysis (NTA). It considers key tasks, including trafic classification, intrusion detection, attack classification, and trafic characteristic prediction. The review covers techniques, practical applications, requirements, challenges, and current projects that illustrate the role of XAI in ensuring security, optimizing performance, and improving network reliability. Particular attention is paid to the transparency of AI model decisions, as in critical environments it is important not only to obtain accurate results, but also to understand the reasons behind them. The proposed study forms a holistic vision of XAI for NTA and can serve as a guide for researchers and practitioners in creating explainable and trusted cybersecurity systems.
The goal of our research is to develop and evaluate machine learning models for network trafic analysis using Explainable AI, aimed at improving threat detection accuracy and ensuring interpretability of results in cybersecurity systems.
The dataset used in this study was based on the UNSW-NB15 dataset created by the Australian Centre for Cyber Security (ACCS) [27]. It combines characteristics of real normal trafic with malicious scenarios that reflect current attack vectors in networks. The resulting dataset contained 38 input features describing network attributes, time parameters, packet and byte statistics, protocol and service characteristics.
Each entry corresponded to a separate network interaction session and was used to classify trafic as normal or malicious. The dataset covers a wide range of attacks, including DoS, Exploits, Fuzzers, Backdoors, Generic, Analysis, Shellcode, Reconnaissance, and Worms, making it suitable for comprehensive evaluation of intrusion detection systems. Figure 1 shows the distribution of classes in the dataset using a logarithmic scale on the Y-axis.
The output parameter in the research is a binary variable that indicates whether network trafic belongs to the normal or abnormal class. A value of 0 corresponds to legitimate trafic (Normal), while a value of 1 combines all types of attacks (Attack). This approach allowed us to formulate the task as a binary classification problem and simplified the training of machine learning models by generalizing the multi-class structure of the dataset.
To build and evaluate the efectiveness of machine learning models, the formed dataset was divided into training and test sets in a 70/30 ratio, ensuring that the structure of the target variable was preserved. The division was carried out according to the principle of stratified splitting, which means proportional representation of each class of attacks in the training and test subsets. Thus, for each type of attack, the data was distributed in a ratio of 70% for training and 30% for testing, which prevents class distribution bias and ensures the representativeness of both subsets.
In this study, modern machine learning methods were used to analyze network trafic and classify attacks, including Random Forest (RF), Extreme Gradient Boosting (XGBoost), and a multilayer neural network of the MLP type.
Random Forest (RF) is an ensemble machine learning method based on building a large number of decision trees using random subsets of data and features. The key principle is the Bagging (bootstrap aggregating) technique, which involves randomly selecting samples for training each tree and then aggregating their results. This approach reduces the risk of overfitting and increases the stability of the model. In classification tasks, the final prediction is determined by voting trees. An important advantage of RF is its ability to work with high-dimensional datasets that include both numerical and categorical features. Extreme Gradient Boosting (XGBoost) is an optimized implementation of gradient boosting that combines high classification accuracy with computational eficiency. Unlike Random Forest, where trees are built independently, XGBoost forms an ensemble sequentially, and each subsequent tree is aimed at correcting the errors of the previous ones. The use of regularization, parallel processing, and memory optimization makes this method extremely productive for large and complex datasets. XGBoost demonstrates excellent results in anomaly and attack detection tasks. A Multilayer Perceptron (MLP) neural network is a classic artificial neural network with multiple layers of perceptrons, where each layer consists of neurons with nonlinear activation functions. Thanks to this architecture, MLP is capable of approximating any complex functions and modeling nonlinear relationships between network trafic features and attack categories. In IDS/IPS tasks, the use of MLP allows for high accuracy, but requires significant computational resources and hyperparameter optimization to avoid overfitting. Despite these challenges, MLP remains one of the basic and at the same time efective approaches for processing complex multidimensional data in the field of cybersecurity.
Explainable artificial intelligence is a field of research aimed at improving the transparency and
interpretability of machine learning algorithms. In the field of cybersecurity, where it is important not
only to obtain an accurate prediction but also to understand the reasons behind it, XAI provides experts
with additional knowledge about which characteristics of network trafic influenced the classification
as normal or malicious activity. Local Interpretable Model-Agnostic Explanations (LIME) is an approach
focused on explaining individual model decisions [
To objectively evaluate the quality of the constructed models, we used a set of classic metrics [29] that are widely used in IDS/IPS research. Accuracy reflects the proportion of correctly classified examples among all observations and characterizes the overall accuracy of the model. However, in cases of class imbalance, it may not be suficiently informative. Recall measures the model’s ability to correctly identify positive examples, i.e., real attacks. A high value of this metric is especially important for cybersecurity tasks, since missed attacks pose the greatest threat. Specificity determines the proportion of correctly classified negative examples, i.e., the model’s ability to correctly identify normal trafic. It is critical for reducing the number of false positives. Precision shows what proportion of all predicted attacks are actually attacks. This metric is important for assessing system reliability, as a high Precision score means a low false alarm rate. F1-Score is the harmonic mean between Precision and Recall, combining them into a single balanced metric. It is especially useful in cases where it is important to consider both missed attacks and false positives. G-Mean (geometric mean) is used for a comprehensive assessment of the balance of classification between classes. It takes into account both Recall and Specificity, providing a more reliable measurement in cases of significant data imbalance. The metrics Accuracy, Recall, Specificity, Precision, F1-score, and G-Mean were determined using standard formulas (Table 1) based on four key classification indicators: TP (true positives), TN (true negatives), FP (false positives), and FN (false negatives).
The log loss function is one of the basic metrics for evaluating probabilistic models in binary classification tasks. It measures how well the model’s confidence in its predictions matches the actual classes [30]. If the model predicts the correct class with high probability, the contribution to the log loss value will be minimal. If it is wrong and at the same time shows excessive confidence (for example, predicts an “attack” with a probability of 0.99, but in fact it is “normal trafic”), the penalty in the loss function will be very large. For a binary classification task, log loss is defined as follows: 1 ∑︁( · ln( ) + (1 − ) · ln(1 − )), LogLoss = − =1 (1) where denotes the total number of samples in the dataset, ∈ {0, 1} is the true class label for the i-th example, and is the probability assigned by the model to the positive class.
If the model is absolutely confident in its prediction and it coincides with reality, the sum of the addends approaches zero. In the case of an incorrect prediction with high confidence, the value of the logarithmic term becomes very large in magnitude, which increases the overall log loss. Thus, log loss is sensitive not only to the correctness of the classification, but also to the distribution of probabilities that the model assigns to classes. This makes it a useful metric for evaluating models focused on probabilistic predictions, especially in the field of anomaly detection and network attacks, where it is important not only to classify correctly, but also to have a measure of confidence in the decision.
In addition to these metrics, additional evaluation tools were used. Visualization using a confusion matrix shows the relationship between true positives, negatives, and false classifications. Another important indicator is the Area Under the ROC Curve (AUC), which characterizes the algorithm’s ability to separate the positive class from the negative class at diferent classification thresholds and determines the overall discriminatory power of the model. Equally important are Precision-Recall curves, which reflect the interdependence between Precision and Recall for diferent threshold values and are particularly informative in cases of significant class imbalance, which is typical for attack detection tasks. Using these methods in combination with classical metrics allows us to obtain a comprehensive view of model performance, identify their strengths and weaknesses, and make a reasonable comparison of results.
For each machine learning method, confusion matrices were constructed and basic classification metrics were calculated. Since neural networks showed the highest accuracy among all the algorithms studied, an extended analysis was performed for the MLP model. Precision-Recall, ROC, and F1-score vs Threshold curves were constructed. In addition, Permutation Importance and LIME analysis were used to explain the model’s decisions.
For the Random Forest model, an ensemble of 620 decision trees was used, which were constructed according to the Gini criterion. The model was not limited by the maximum depth of the trees, which allowed complex dependencies to be reproduced, while the number of features at each split was determined by the sqrt rule. To compensate for class imbalance, the class_weight=balanced_subsample strategy was used, with a minimum of one example in the leaf and two for the split. The algorithm ran in multiprocessing mode (n_jobs=-1) with reproducible results thanks to a fixed random state (random_state=42). For this model, the optimal hyperparameters were selected using the GridSearchCV exhaustive search method, which allowed us to find the most balanced parameter values. In the case of XGBoost, the settings were focused on the task of binary classification with a logistic loss function (objective=binary:logistic, eval_metric=logloss). The number of trees was 680 with a maximum depth of six, and the learning rate was 0.05. To reduce the correlation between trees, partial subsampling parameters were used (colsample_bytree=0.9 and subsample=0.9). Positive class balancing was ensured by the scale_pos_weight=0.5647 coeficient, and regularization was performed with the reg_alpha=0.0 and reg_lambda=1.0 parameters. To speed up training, the tree_method=hist tree construction method was used, and the random state was also fixed (random_state=42). The optimal values of the hyperparameters of this model were also selected by searching GridSearchCV, which ensured maximum classification quality. The multilayer neural network of the MLP type consisted of two hidden layers with 128 and 64 neurons with the ReLU activation function. Network weight optimization was performed using the Adam algorithm with parameters beta_1=0.9, beta_2=0.999, and momentum=0.9. The initial learning rate was set to 0.001, with adaptive learning rate adjustment (learning_rate=adaptive). To increase the stability of the model, early stopping (early_stopping=True) was used with a validation data fraction of 0.1, the maximum number of iterations was 200, and the number of optimization function calculations was limited to 15,000. The input features were scaled using StandardScaler, which ensured better algorithm convergence, and the reproducibility of the results was guaranteed by a fixed random state (random_state=42). For MLP, the optimal values of hyperparameters were selected using the RandomizedSearchCV random search method, which allowed us to quickly explore the parameter space and obtain a high-quality model configuration. Figure 2 shows confusion matrices illustrating the classification results using three machine learning methods.
(a) (b) (c)
Table 2 shows the detailed performance indicators of the models. A comparative analysis demonstrated diferences in classification quality between the three methods considered. Random Forest demonstrated the worst result among the algorithms considered. The overall accuracy is 0.9358, and the average precision and recall are significantly lower compared to other models, indicating a higher number of misclassifications. The XGBoost model shows a much better balance, achieving an accuracy of 0.9473 and high precision (0.9813 for attacks) and recall (0.9685 for normal trafic) values. However, its log loss is 0.1131, indicating lower confidence in predictions compared to MLP. The MLP neural network demonstrates the highest overall accuracy of 0.9508 and the lowest log loss of 0.0793, which means more stable and confident predictions. Also, the F1-score for both classes in MLP exceeds the corresponding indicators of other algorithms, and the G-Mean value confirms the balance of classification. Thus, among the methods studied, the MLP model proved to be the most efective for classifying network trafic. In the process of evaluating the performance of the MLP model, several important visualizations were obtained, which allowed for a comprehensive analysis of its work. Figure 3 shows the Precision-Recall curve, the ROC curve with the AUC indicator, and the F1-score vs. Threshold for the MLP model.
The graph showing the dependence of the F1-score on the threshold value indicates that the best balance between Precision and Recall is achieved at a threshold of 0.54. This indicates that the correct choice of classification threshold is critical for maximizing model performance, as too low or too high values lead to a decrease in F1-Score due to an imbalance between false positives and false negatives. Analysis of the Precision-Recall curve showed very high performance with an average AP curve area of 0.99572, confirming the model’s ability to maintain high accuracy. This result is particularly important in attack detection tasks, where an excessive number of false alarms reduces the efectiveness of the security system. The ROC curve showed similarly high classification quality, with an AUC area under the curve of 0.99224, close to the ideal value. This means that the model has excellent discriminatory power and is able to clearly distinguish normal trafic from malicious trafic. An AUC value close to 1.0 confirms that even with variable classification thresholds, the model maintains a consistently high level of accuracy. The combination of high F1-Score, AP, and AUC values indicates the high efectiveness of MLP for attack detection tasks. The visualizations obtained not only confirm the quality of the model but also provide a clear picture of its behavior in conditions of class imbalance, allowing for a reasonable assessment of its suitability for use in cyber defense systems.
Ensuring the interpretability of machine learning results is one of the important tasks in the field of cybersecurity, since the transparency of decisions determines the trust of experts in the attack detection system. To explain the operation of the MLP model, two approaches from the Explainable AI arsenal were used: Permutation Feature Importance and LIME. Figure 4 shows an example of a local prediction explanation for sample #45078, classified as Attack.
The sttl (source time to live) feature made the biggest contribution to the decision, significantly pushing the model to choose the Attack class with a weight of over 0.21. The ct_state_ttl (number of connections with a similar state and TTL) and swin (TCP window size on the source side) indicators also proved to be important, strengthening the model’s confidence in classifying the trafic as malicious. The indicators sloss (number of lost packets from the source), is_sm_ips_ports, and sbytes (volume of bytes transferred from source to destination) also had a positive efect on the classification. At the same time, features such as dttl (destination time to live), ct_dst_src_ltm (number of connections between the same source and destination within a specified time interval), and dbytes (volume of bytes transferred from destination to source) reduced the probability of classifying an example as Attack. However, their impact was less significant. This analysis demonstrates that the model’s decision was based on time parameters and protocol characteristics (TTL, TCP window, delays) and statistical properties of flows (number of packets, byte volume, losses), confirming the use of a comprehensive set of features. For global analysis, the Permutation Feature Importance method was used, the results of which are shown in Figure 5.
As can be seen, the most significant parameters for classification are sttl, ct_dst_src_ltm, and sbytes. These features determine the overall behavior of trafic and are key to detecting attacks in a network environment. The Permutation Importance results are consistent with the local explanations provided by LIME, confirming the consistency of conclusions regarding the impact of specific characteristics. The combination of global and local approaches provides a deeper understanding of how the MLP model works, allowing us to identify both general patterns in the data and the reasons for decisions in specific cases. This increases the transparency and reliability of the model, which is a prerequisite for practical use in intrusion detection systems.
The laboratory environment was deployed on a KVM hypervisor, which enabled the creation of an isolated multi-component infrastructure for simulating real network conditions and testing IDS. The network consisted of an external segment connected to the Internet and an internal segment (Figure 6).
Several operating systems functioned within the virtual environment, replicating the real corporate infrastructure. Parrot Security OS and Kali Linux were used as environments for simulating attacks and conducting penetration testing. Ubuntu Linux provided a set of basic services (HTTP, DNS, IMAP, SMTP, SSH). Metasploitable VM acted as a vulnerable machine for testing exploits and attacks. Windows Server simulated a corporate environment by providing Remote Desktop Services. It also supported key corporate functions, including Active Directory services for managing user accounts and security policies. Windows Server also had DNS and DHCP services enabled for network infrastructure, file services for resource sharing, and IIS services for testing web applications. This lab environment setup created conditions that were as close as possible to real-world scenarios. The IDS system, integrated into the internal segment, monitored and classified trafic using the MLP model in combination with signature-based and anomaly-based approaches. The laboratory environment made it possible to evaluate the efectiveness of MLP integration into the IDS system.
The paper demonstrates that combining machine learning methods with Explainable AI approaches can significantly improve the efectiveness and trustworthiness of intrusion detection systems. Three machine learning models were developed and compared: Random Forest, XGBoost, and MLP. The MLP neural network showed the best results. The overall accuracy was 0.9508, the smallest log loss among the models was 0.0793, the average AP value on the PR curve was 0.9957, and the AUC ROC was 0.9922. This indicates stable and confident probabilistic predictions and high discriminatory power of the model. The integration of XAI made it possible to transform the model’s “black box” into a tool whose decisions can be explained. Local LIME explanations for individual samples and a global assessment of feature importance based on Permutation Feature Importance consistently pointed to the important role of TTL (sttl) parameters, connection statistics (ct_dst_src_ltm, ct_state_ttl), and data transfer volumes (sbytes, dbytes). This not only increases the confidence of security experts in automated solutions, but also provides practical guidance for IDS/IPS policy formation (e.g., thresholds, event correlation rules, alert prioritization). The KVM-based lab environment with realistic corporate infrastructure made it possible to recreate application scenarios and verify the proposed approach.
During the preparation of this work, the authors used Grammarly in order to grammar and spell check, and improve the text readability. After using the tool, the authors reviewed and edited the content as needed to take full responsibility for the publication’s content. 1–10. doi:10.1145/3600160.3605162. [25] O. Arreche, T. R. Guntur, J. W. Roberts, M. Abdallah, E-XAI: Evaluating black-box explainable AI frameworks for network intrusion detection, IEEE Access 12 (2024) 23954–23988. doi:10.1109/ access.2024.3365140. [26] A. Nascita, G. Aceto, D. Ciuonzo, A. Montieri, V. Persico, A. Pescapé, A survey on explainable artificial intelligence for internet trafic classification and prediction, and intrusion detection, IEEE Communications Surveys & Tutorials (2024). doi:10.1109/comst.2024.3504955. [27] N. Moustafa, J. Slay, UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set), in: 2015 Military Communications and Information Systems Conference (MilCIS), IEEE, 2015, pp. 1–6. doi:10.1109/milcis.2015.7348942. [28] scikit-learn developers, Permutation feature importance, https://scikit-learn.org/stable/modules/ permutation_importance.html, 2024. [29] A. Correndo, Classification performance metrics and indices, https://adriancorrendo.github.io/ metrica/articles/available_metrics_classification.html, 2024. [30] scikit-learn developers, log_loss, https://scikit-learn.org/stable/modules/generated/sklearn.metrics. log_loss.html, 2024.