Explainable AI for Intrusion Detection: A SHAP-Guided Machine Learning Framework for Actionable Cybersecurity Insights

Abstract

The increasing scale, speed, and sophistication of cyberattacks have rendered traditional rule-based intrusion detection systems (IDS) insufficient for modern network environments. While machine learning (ML)-based IDSs have significantly improved detection capabilities, their black-box nature limits trust, interpretability, and practical deployment in real-world security operations. To address this challenge, this paper proposes an explainable machine learning framework for network intrusion detection using the CICIDS2017 dataset. The framework integrates multiple supervised learning models, including baseline and ensemble classifiers, and evaluates them using standard performance metrics such as accuracy, precision, recall, F1-score, and ROC-AUC. To enhance transparency, Shapley Additive exPlanations (SHAP) are employed to quantify feature contributions and provide both global and instance-level interpretability of model predictions. Experimental results demonstrate that ensemble models achieve superior detection performance while maintaining high interpretability. Furthermore, the explainability analysis reveals key traffic characteristics associated with different attack behaviors, providing deeper insight into attack behavior and supporting security analysts in interpreting intrusion alerts. The proposed approach improves detection accuracy, reduces false positives, and supports informed decision-making, thereby enhancing the transparency, trustworthiness, and practical applicability of intrusion detection systems.