Explainable BiLSTM-Attention based Intrusion Detection with Adaptive Imbalance Handling

Abstract

IDS is a crucial element in defending against dynamic, emerging cyberattacks on modern network infrastructure. The current deep learning intrusion detection systems, however, suffer from three primary drawbacks: a lack of modeling temporal traffic dependencies, an inability to effectively handle class imbalance, and low interpretability for security analysts. To address these problems, this paper presents an explainable BiLSTM-Attention intrusion detection framework that leverages SMOTE-ENN-based adaptive imbalance handling for IDS2018 traffic. The proposed framework combines Chi-Square-based feature selection, Lasso-based feature selection, SMOTE-ENN-based class balancing, and BiLSTM-based bidirectional temporal learning with the attention mechanism highlighting informative traffic patterns. There is also a feature-level interpretation stage to increase the transparency of intrusion decisions. The model was tested on a processed dataset of IDS2018 samples, comprising 7,517 samples and 78 features for traffic classification in a binary intrusion detection scenario. The accuracy, precision, recall, F1-score, MCC, and false alarm rate of the proposed BiLSTM-Attention + SMOTE-ENN framework are 94.41%, 80.26%, 99.20%, 88.73%, 0.8592, and 6.95%, respectively, according to experimental results. Additionally, the model's inference latency was 0.0339 ms per sample, suggesting it is suitable for near-real-time intrusion detection. The results validate the effectiveness of attention-based recurrent IDS models on sampled IDS2018 traffic through adaptive imbalance handling.