Enhancing cybersecurity with Explainable Artificial Intelligence: technical framework and applications in training labs

Abstract

Cyberattacks are growing in complexity, and machine-learning-based intrusion detection systems (IDS) are increasingly adopted to support scalable threat monitoring. However, high-performing models can be operationally difficult to deploy when their decisions are not interpretable or auditable. This paper studies explainability as a decision-support component in an IDS workflow rather than as a purely visual add-on. Using the UNSW-NB15 benchmark, we compare three widely used classifiers—Random Forest (RF), Decision Tree (DT), and Support Vector Machine (SVM)—and then analyse the strongest performer (RF) with post-hoc explainability tools: Local Interpretable Model-Agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP). RF achieved 95.3% accuracy (precision 94.8%, recall 96.1%, F1-score 95.4%), exceeding DT and SVM on the same split. LIME and SHAP consistently highlighted traffic-volume and duration-related features (e.g., destination bytes, source bytes, and flow duration) as influential drivers of intrusion predictions, providing actionable hypotheses for analyst triage and policy refinement. We further discuss how explanation outputs can be operationalized in cybersecurity training labs through auditable “rationale artifacts,” while clarifying that any observed reduction in false positives should be interpreted as the outcome of explanation-guided interventions (e.g., threshold tuning and triage rule adjustments) rather than a direct causal effect of generating explanations. Finally, we outline necessary research extensions—controlled baselines, robustness testing, and explanation stability/faithfulness analysis—to ensure reliable deployment of LIME/SHAP in safety-critical IDS settings.

1 Introduction

The digital revolution has transformed contemporary society into a highly interconnected environment that enables communication, commerce, and innovation. Nonetheless, this rapid digitalization has also brought with it a frightening increase in cyber threats, prompting cybersecurity to become one of the most important concerns of individuals, businesses, and governments. Cyber-attacks have become highly complex, attacking critical infrastructures, financial institutions, healthcare systems, government networks, and in most cases causing catastrophic financial, operational, and reputational harm.

According to the recent statistics, there has been a 16-fold growth in the number of victims of cybercrime since 2001, and the global financial losses have grown nearly 570 times, that is, changes to $2,000 per hour into 1.2 million per hour (Cybercrime Statistics, 2025). The digital ecosystems have vulnerabilities that attackers use to exploit advanced techniques such as Advanced Persistent Threats (APT), DDoS, ransomware, phishing, and zero-day exploits. The use of traditional rule-based methods of cybersecurity is unable to scale back these emerging threats because they operate based on pre-defined attack signatures and will not be able to counter new attack patterns (Capuano et al., 2022).

Although previous studies have successfully integrated machine learning models with post-hoc explainability techniques such as SHAP and LIME for intrusion detection, these approaches generally employ explainability as a mechanism for interpreting model predictions after classification rather than as an integral component of operational decision-making. Consequently, explanations often improve transparency but are not systematically translated into actions that enhance security operations.

To address this limitation, this study proposes an Explainability-as-Intervention (XAI²) framework in which explainability serves as an operational decision-support mechanism rather than merely an interpretation layer. The framework explicitly distinguishes three controlled experimental conditions: (i) baseline intrusion detection without explainability (C0), (ii) explanation generation without intervention (C1), and (iii) explanation-guided intervention (C2), where predefined operational rules utilize SHAP and LIME outputs to support threshold calibration and alert refinement. By separating explanation generation from explanation-guided intervention, the proposed framework enables a more rigorous evaluation of how explainability contributes to operational cybersecurity decision-making without attributing improvements directly to the explainability algorithms themselves.

1.1 Research gap and contribution

The principal contributions of this study are summarized as follows:

• An Explainability-as-Intervention (XAI²) framework is proposed that integrates explainability into operational intrusion detection workflows, extending the role of explainable AI beyond conventional post-hoc model interpretation.

• A controlled experimental design is introduced by separating baseline prediction (C0), explanation-only analysis (C1), and explanation-guided intervention (C2), enabling a clearer assessment of the operational impact of explainability.

• A structured decision-support workflow is developed that converts explanation outputs generated by SHAP and LIME into predefined operational actions, including threshold calibration and alert refinement, while preserving the underlying machine learning model.

• An operational evaluation is presented to demonstrate how explanation-guided interventions can improve the interpretability and practical usability of intrusion detection systems without modifying classifier architecture.

• Practical deployment implications are discussed for integrating explainable AI into cybersecurity operations, including transparency, auditability, analyst trust, and operational decision support.

1.2 The need for explainable AI in cybersecurity

The increasing adoption of artificial intelligence (AI) and machine learning in cybersecurity has significantly enhanced the capability of intrusion detection systems (IDS) to identify complex and previously unseen attack patterns (Chamola et al., 2023). However, these high-performing models often operate as black-box systems, where the internal decision-making processes are not readily interpretable (Ali et al., 2023). This lack of transparency presents a critical challenge for real-world deployment in security-sensitive environments.

In cybersecurity operations, the ability to understand and justify decisions is essential. Security analysts must be able to determine why a particular network activity is classified as malicious to assess its validity, reduce false positives, and take appropriate response actions. Without interpretability, AI-generated alerts may be difficult to trust, potentially leading to delayed responses or the dismissal of valid threats.

Explainable Artificial Intelligence (XAI) addresses this limitation by providing human-understandable explanations of model predictions. Techniques such as Local Interpretable Model-Agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP) enable analysts to identify the key features influencing a decision and evaluate whether the model's reasoning aligns with domain knowledge (de Sousa et al., 2019; Li, 2022; Hariharan et al., 2023). This enhances transparency, supports validation of AI outputs, and facilitates more informed decision-making.

Beyond interpretability, explainability also plays an important role in regulatory compliance and accountability (Suri, 2020). As cybersecurity systems increasingly operate within regulated environments, organizations must ensure that automated decisions can be audited and justified. XAI contributes to this requirement by making model behavior more transparent and traceable (Sharma et al., 2025).

In this study, explainability is treated as an operational component within the intrusion detection workflow (Capuano et al., 2022). The proposed framework integrates XAI techniques with machine learning models to enable both accurate threat detection and actionable insights (Sarker et al., 2024).

1.3 Research aim and contributions

This study develops an explainable intrusion detection framework that integrates machine learning with explainability-driven interventions. Unlike prior work, explainability is treated as an operational mechanism rather than a post-hoc visual tool.

The key contributions are as follows. First, we introduce an Explainability-as-Intervention (XAI²) framework that distinguishes between baseline, observation, and intervention conditions (Rjoub et al., 2023). Second, we evaluate explanation quality through stability and faithfulness metrics (Aslam et al., 2022). Third, we provide a structured mapping from explanation outputs to actionable cybersecurity decisions, including threshold calibration and triage refinement (Sharma et al., 2025).

2 Literature review

Cyber threats are becoming increasingly complex. This trend has made the necessity of intelligent, adaptive, and explainable security mechanisms more urgent than ever. Existing traditional cybersecurity frameworks, based on variable Rule Sets, use static Signature-based and Heuristic-based detection systems that have limited accuracy because of the inability to fight the ever-changing sophisticated threats like polymorphic malware, Zero-day exploits, APTs, etc.

In response to this threat, artificial intelligence and machine learning have been used to detect threats more effectively and automate incident response. These AI-driven systems have significantly improved threat detection capabilities; however, a major limitation remains the lack of transparency. Security professionals face the challenge of being unable to trust, validate, or refine an AI model because they cannot explain how and why it identifies a cyber threat.

The theoretical foundation, studies, and current research on cybersecurity XAI are covered in this section. First, it takes some time to discuss some of the core theoretical framework(s): XAI Theory, Transparency Theory in Cybersecurity, and Causal Explanations Theory. It then moves on to the general literature on AI-based intrusion detection systems, the relevant literature on LIME, and SHAP. Then, empirical studies in the areas of intrusion detection and cyber threat analysis that make use of explainable AI to gain practical value are reviewed.

Existing explainable intrusion detection studies have predominantly employed SHAP, LIME, or related post-hoc explainability techniques to improve the transparency of machine learning models and assist analysts in understanding prediction outcomes. While these approaches significantly enhance model interpretability, explainability generally remains an observational component that does not directly influence operational decision-making. Recent studies have also highlighted the importance of integrating explainability into cybersecurity governance, trustworthy AI, and risk management frameworks, emphasizing the need for explainability that supports practical security operations rather than merely providing visual interpretations (Papastergiou et al., 2026; Mutalib et al., 2024; Milani et al., 2022). In contrast, the proposed Explainability-as-Intervention (XAI²) framework explicitly incorporates explanation outputs into predefined operational procedures, allowing explainability to guide threshold calibration, alert refinement, and validation of intrusion alerts. Consequently, the contribution of this work lies not in introducing new explainability algorithms, but in proposing an operational framework that systematically integrates explainability into the cybersecurity decision-making process.

To better position the proposed framework within the current state of the art, Table 1 compares representative explainable AI-based cybersecurity studies with the proposed Explainability-as-Intervention (XAI²) framework. The comparison demonstrates that, while previous studies have successfully employed explainability techniques such as SHAP and LIME to improve model transparency and support cybersecurity analysis, they primarily utilize explainability for post-hoc interpretation. In contrast, the proposed framework extends explainability into the operational decision-making process by explicitly distinguishing explanation generation from explanation-guided intervention.

As shown in Table 1, previous studies have made significant contributions to improving the transparency, interpretability, and trustworthiness of AI-based cybersecurity systems through explainability techniques. However, these studies primarily focus on generating explanations to support model interpretation or high-level decision support. None explicitly evaluate the operational impact of explanation-guided intervention using a controlled experimental design. The proposed Explainability-as-Intervention (XAI²) framework extends existing research by introducing three controlled conditions—baseline prediction without explainability (C0), explanation-only observation (C1), and explanation-guided intervention (C2). These studies demonstrate that explainability is increasingly being integrated into operational cybersecurity workflows. The proposed Explainability-as-Intervention (XAI²) framework extends this direction by explicitly evaluating explanation-guided intervention as a controlled experimental factor, complementing recent work on dynamic cybersecurity risk management and trustworthy AI (Papastergiou et al., 2026).

The inclusion of recent studies (Goncalves and Alomari, 2026; Melendrez et al., 2025; Khan et al., 2026; Prasad et al., 2026; Papastergiou et al., 2026) further demonstrates that contemporary explainable cybersecurity research is increasingly shifting from post-hoc model interpretation toward operational decision support, cloud-native intrusion detection, explainable ensemble learning, IoT security, and cyber-risk management. Building upon these developments, the proposed Explainability-as-Intervention (XAI²) framework contributes by explicitly evaluating explanation-guided intervention as a controlled component of the intrusion detection workflow, thereby extending explainability from interpretation to actionable cybersecurity operations.

2.1 Theoretical foundations of XAI

Explainable Artificial Intelligence (XAI) refers to a class of methods that enable human users to understand, trust, and effectively manage AI system outputs by providing interpretable representations of model behavior. Within the context of this study, black-box models refer to classifiers whose decision-making mechanisms are not inherently transparent, necessitating external explanation techniques such as LIME and SHAP.

Two widely used model-agnostic XAI techniques are employed in this study:

• LIME (Local Interpretable Model-Agnostic Explanations): approximates complex models locally using interpretable surrogate models to explain individual predictions.

• SHAP (Shapley Additive Explanations): assigns each feature a contribution value based on cooperative game theory, ensuring consistency and global interpretability.

In this context, black-box intrusion models refer to machine learning models whose internal decision processes are not directly interpretable (e.g., Random Forest, SVM), while baseline conditions refer to experimental settings where no explainability-driven modifications are applied. For a robust cybersecurity framework with XAI, it is imperative to comprehend the theoretical basis of support for the explainable machine learning models.

2.1.1 Theory of XAI

According to the Theory of XAI, AI models should not work as black boxes but give visible and clear, interpretable justifications for their decisions (Hulsen, 2023). Here is this principle in the context of cybersecurity, as security analysts need to be able to appreciate the underlying reasons behind an AI-generated alert to assess whether it is a true threat or not.

Mission-critical security operations have a high demand for explainability, as decisions based on AI can result in severe consequences. False positive or false negative outcomes in the classification of network activities performed by the AI systems have grave consequences, such as improper system shutdowns and undetermined security risks.

The convergence of big data analytics and AI in online streaming media, as pointed out in (Arshad et al. 2025), implies the role played by AI in reshaping customer experience and business optimisation and in motivating the use of XAI in cybersecurity to ensure transparency and trustworthiness. It can be supported by (Ilyas et al. 2022), who notes the increased applicability of AI-driven recommender systems in customer interactions, and the necessity to use XAI in cybersecurity to achieve a better degree of interpretability and transparency in decision-making. The contribution of interpretability in AI decision-making systems is further evidenced by (Adak et al. 2022), who depicted utilizing XAI in unboxing deep learning systems for analyzing online reviews of a meal delivery platform, and (Ali et al. 2023), who emphasized the contribution of utilizing XAI in reaching trustworthy AI systems, presenting advances and challenges in assuring transparency and responsibility.

In a similar vein, (Aslam et al. 2022) discussed utilizing interpretable machine learning systems in conjunction with XAI for identifying dangerous domains, depicting ways in which explainability can make cybersecurity systems more credible, and (Chamola et al. 2023) proposed an in-depth survey of trustworthy XAI, emphasizing its contribution in making AI systems in a variety of fields more credible and transparent. The contribution of utilizing XAI in making Internet of Things systems more credible and transparent was further discussed by (Kök et al. 2023), who proposed a survey on its utilization in the Internet of Things, and by (Lundberg et al. 2022), who experimentally discussed utilizing XAI in developing trustworthy in-vehicle intrusion systems, emphasizing interpretability in automobile cybersecurity.

Closing gaps between human trust in artificial decision-making, particularly in driverless cars, was tackled by (Machlev et al. 2022) and (Speith 2022), which analyzed various taxonomies of strategies for XAI, presenting a well-structured summary of strategies for making AI interpretable. In medicine, (der Velden et al. 2022) analyzed using XAI in medical image diagnosis using deep learning, emphasizing its role in making diagnosis systems transparent, and (Rjoub et al. 2023) analyzed using XAI in cybersecurity, emphasizing its role in making AI-powered systems for intrusion interpretable and accountable.

Beyond cybersecurity, (Mishra and Morisetty 2022) made a determination of the ultimate tensile strength of friction stir- jointed joints using algorithms under supervision, emphasizing the applicability of machine learning in manufacturing, and (Suri 2020) analyzed the ethics of doing systematic studies in education studies, emphasizing transparency and accountability in doing studies. In other fields, (Patra et al. 2021) was analyzed using the random forest algorithm in imbalanced genomics classification, emphasizing applicability in managing imbalanced datasets and further emphasizing interpretable strategies in machine learning.

The applicability of utilizing XAI in clinical diagnosis was further illustrated by (de Sousa et al. 2019) using LIME in classifying lymph node metastases and by (Li 2022) using SHAP and XGBoost for identifying spatial influences in algorithms for machine learning, emphasizing urban systems studies in their local interpretability. Explainable AI has been successfully applied in various domains, such as predicting material properties in civil engineering, where (Mohammed et al. 2025) employed XAI methods to predict the compressive strength of soil and ground granulated blast furnace slag mixtures. This is the best method not only to enhance the accuracy of prediction but also to guarantee transparency in the decision-making process, which is very important when implementing AI in a critical system, such as cybersecurity.

The paper (Hariharan et al. 2023) reviewed the explanations in XAI of intrusion systems with an emphasis on interpretability as an essential component, and (Boateng et al. 2020) explored the principles of algorithms used to classify data, such as K-nearest neighbor, support vector machines, random forests, and neural networks, which makes it a platform to understand how it applies to the study of data. Ultimately, (Antoniadi et al. 2021) systematically reviewed clinical decision support system opportunities and challenges for XAI, emphasizing transparency in medical AI as a necessity in support of the broader point of explainability being an imperative, not an augmentation, in a variety of fields.

2.1.2 Transparency theory in cybersecurity

The Cybersecurity Cipher Theory focuses on the fact that cybersecurity models driven by AI need to be both transparent and interpretable for cybersecurity professionals to trust or rely on such implementations of them (Sudar et al., 2022). The theory states that when security analysts know how AI gets to conclusions, then they can:

• Validate AI-generated threat alerts, reducing unnecessary interventions.

• Identify biases in AI-driven threat detection models.

• Enhance human-AI collaboration by making security operations more explainable.

Decision Trees and Random Forest are white-box AI models that are quite compatible with this theory since they offer clear decision paths, and therefore, their predictions can be more easily understood.

2.1.3 Casuals explanation theory

Causal Explanations Theory is of the opinion that AI models, other than their classification as a threat, should explain the cause-and-effect relationships that led to their classification (Machlev et al., 2022). Cyberspace. It is very important in cyberspace to know why an AI model considers network activity an intrusion so that security policies and system resilience can be fine-tuned.

An example is when an Intrusion Detection System (IDS) operated by AI detects an abnormal activity on the network, causal explanations may be:

• Which features contributed most to the detection?

• Was the anomaly triggered by normal user behavior or a genuine attack?

• How do modifying network parameters affect threat classification?

Causal AI models provide these insights, making them more reliable, accountable, and actionable in real-world cybersecurity settings.

2.2 Technical Foundations of XAI methods

LIME approximates a complex model locally by fitting a weighted linear surrogate model:

where f is the original model, and πx defines the locality around the instance x.

SHAP assigns feature importance using Shapley values, which represent the weighted average marginal contribution of a feature across all possible coalitions:

where N is the complete set of features and S represents a subset of features excluding the i-th feature.

2.3 General literature on AI cybersecurity

The general literature surrounding the application of Explainable Artificial Intelligence (XAI) in cybersecurity casts a broad net over the practical implications and real-world scenarios where transparency and interpretability play pivotal roles. This body of work extends beyond the theoretical constructions and dives into the pragmatic use cases of XAI in safeguarding computer networks.

2.3.1 Rise of AI-driven intrusion detection systems (IDS)

The application of AI and machine learning has transformed the cybersecurity sphere, rendering network intrusions automatic. The IDS systems that are based on rules are decided based on historic attack signatures and behavior patterns and hence become ineffective against advanced and dynamic attacks.

AI IDS uses pattern recognition, anomaly detection, and prediction analytics to identify new threats in cyberspace. The following are some of the popular AI models applied in cybersecurity:

• Random Forest (RF): An ensemble learning algorithm that improves classification accuracy through multiple decision trees.

• Support Vector Machines (SVM): Effective for classifying network traffic into malicious or benign.

• Deep Learning Models (CNN, RNN, LSTM): Used for detecting complex network attack patterns but suffer from interpretability issues.

Despite their effectiveness, black-box models like deep learning remain a challenge due to a lack of transparency, necessitating the integration of XAI techniques.

2.3.2 Model-agnostic XAI techniques

To address such a lack of transparency in AI-powered cybersecurity, scholars have devised model-agnostic explainability techniques, including:

• LIME: Provides localized explanations by approximating AI models, whether black-box or otherwise, using interpretable models.

• SHAP: Utilizes game theory to allocate to each feature in an AI model's prediction a quantitative amount reflecting their individual contributions, presenting an overall description of model behavior.

Research indicates that SHAP and LIME improve the interpretability of AI-based intrusion detection systems by providing explanations that can support cybersecurity decision-making and operational analysis (Owens et al., 2022). Recent cloud-based intrusion detection research further demonstrated that both SHAP and LIME improve the interpretability of alerts generated by AWS GuardDuty, enabling more transparent investigation of security events and supporting operational decision-making in cloud environments (Goncalves and Alomari, 2026). In the proposed framework, these explanations are incorporated into a predefined intervention protocol that simulates analyst-informed operational decisions rather than direct interaction with human analysts. Equally, AI methods have already been demonstrated to be useful in other safety-critical systems, including creating digital twin-based safety monitoring in university labs (Xu et al., 2025). The conceptual framework is like cybersecurity systems in which real-time threat detection is the key element of the design, and this design method utilizes real-time data and AI as its monitoring tool.

2.4 Empirical studies on XAI in cybersecurity

In the unceasing battle against cyber threats and attacks, the integration of Explainable Artificial Intelligence (XAI) has emerged as a potential gamechanger. The empirical literature in cybersecurity delves into the practical application and evaluation of XAI techniques, emphasizing their effectiveness in enhancing security measures. This section will provide a comprehensive overview of empirical studies contributing to the empirical evidence regarding XAI's role in network intrusion detection, rule-based intrusion detection, and the analysis of causal explanations for cyber threats.

2.4.1 Evaluating XAI in network intrusion detection

An experiment by (Ahmed and Piccialli 2022) turned out to be more interpretable when applying black-box intrusion models, such as Random Forest and Support Vector Machines, evaluated under baseline (no XAI) and explainability conditions (with LIME and SHAP). In this study, black-box intrusion models refer to machine learning classifiers whose internal decision processes are not directly interpretable, particularly ensemble methods (e.g., Random Forest) and kernel-based models (e.g., SVM). These models require post-hoc explainability techniques to provide human-understandable insights. The authors reported that explainability techniques improved the interpretability of AI-generated intrusion alerts, enabling more informed cybersecurity decision-making. These findings motivated the simulated analyst-informed intervention workflow proposed in this study rather than serving as evidence of direct human-participant evaluation.

2.4.2 Optimization of rule-based intrusion detection with XAI

The authors of (Capuano et al. 2022) was done to examine the effectiveness of XAI and rule-based IDS in detection. Explainability was employed to trace the decisions taken by AI, and it prevented false alarms and maximized response strategies.

2.4.3 Recent trends in XAI-based cybersecurity

Recent research demonstrates that explainable artificial intelligence is rapidly evolving from a tool for improving model interpretability into a foundation for trustworthy and operational cybersecurity decision-making. (Sarker et al. 2024) highlighted the role of explainable AI in cybersecurity automation, intelligence, and digital-twin-enabled trustworthiness, while (Sharma et al. 2025) provided a comprehensive review of explainable AI techniques for cybersecurity applications. More recent studies have further strengthened this direction. (Goncalves and Alomari 2026) demonstrated the effectiveness of SHAP and LIME for explaining cloud intrusion alerts generated by AWS GuardDuty, while (Melendrez et al. 2025) employed SHAP to interpret ensemble intrusion detection models based on XGBoost and CatBoost. Similarly, (Khan et al. 2026) proposed an XAI-driven data mining framework for self-defending IoT systems, illustrating the growing role of explainability in autonomous cyber-defense for smart-city environments. (Prasad et al. 2026) further showed how explainable AI enhances cybersecurity decision-making by improving transparency and supporting trustworthy threat analysis. (Papastergiou et al. 2026) extended explainability beyond model interpretation by integrating XAI into dynamic cybersecurity risk management and cyber-insurability. Collectively, these studies demonstrate the growing emphasis on operational explainability in cybersecurity and provide a strong foundation for the proposed Explainability-as-Intervention (XAI²) framework.

3 Research methodology

The study utilizes the methodological framework, distinct from experimental results, and focuses on dataset preparation, model configuration, and evaluation design. The experiments were conducted using the publicly available UNSW-NB15 benchmark dataset developed by the Australian Center for Cyber Security (ACCS), which contains modern synthetic network traffic representing both benign activities and multiple categories of contemporary cyberattacks. The official training and testing files released with the benchmark were used as the basis for all experiments. Experimental findings are reported separately in Section 4 to ensure conceptual clarity and reproducibility.

A structured and systematic methodology is essential for ensuring the validity and reliability of research. For network data complexity, machine learning model interpretability, and the need for insights to act on them, in the context of explainable artificial intelligence and cybersecurity, point toward having a good methodology for research. The following section presents the methodology, approach, data collection, tools, and analytical techniques for this piece of research.

The primary objective of this research is to develop and evaluate an XAI-based network intrusion detection model, demonstrating how explainability enhances cybersecurity frameworks. To achieve this, the research employs a mixed-methods approach, combining quantitative data analysis (for machine learning model evaluation) and qualitative insights (for explainability assessment using LIME and SHAP).

3.1 Research design

This study adopts a descriptive research design to systematically examine the role of explainable artificial intelligence (XAI) in enhancing cybersecurity within network intrusion detection systems. The design enables a structured analysis of how machine learning models perform in detecting cyber threats and how explainability techniques contribute to interpreting and validating these decisions.

The approach focuses on analyzing relationships between model performance, interpretability, and operational outcomes. It facilitates the evaluation of how explainability techniques such as LIME and SHAP provide insight into model behavior and support decision-making processes in cybersecurity contexts. Rather than solely developing a predictive model, the research emphasizes the integration of interpretability into the detection workflow. This allows for a clearer understanding of how AI-driven decisions can be assessed, validated, and refined, thereby strengthening the connection between automated detection and human-centered cybersecurity operations.

3.2 Research approach

A mixed-methods methodology is adopted, using quantitative and qualitative strategies to provide in-depth insights into AI-powered cybersecurity.

3.2.1 Quantitative approach

The quantitative component is machine learning model testing and training on datasets in cybersecurity. The UNSW-NB15 dataset, an accepted network intrusion detection benchmark, is employed for testing and validating models. Effects are measured by metrics such as model performance, including precision, F1-score, and accuracy.

3.2.2 Qualitative approach

The qualitative component is to interpret decisions made by models using XAI tools (SHAP and LIME). The goal is to compare explanations offered by XAI and to observe whether and to what degree security professionals can comprehend and utilize such insights in realistic settings.

3.3 Data collection

The study is conducted using the UNSW-NB15 dataset, an official dataset for network intrusion detection. The dataset is made by the Australian Center for Cyber Security (ACCS) and comprises authentic network traffic, including benign behavior and malicious attacks.

3.3.1 Justification for dataset selection

The UNSW-NB15 dataset is chosen for various reasons:

• Diversity of attack types: Includes brute-force attacks, network scanning, SQL injection, DDoS, and more.

• High-quality labeling: The dataset is pre-annotated, making it suitable for supervised machine- learning models.

• Feature richness: Comprises 49 network traffic features, covering flow-based, content-based, and time-based attributes.

3.3.2 Dataset pre-processing

Before training machine learning models, data is preprocessed to ensure better accuracy and efficiency. The following steps are undertaken:

• Handling Missing Data: The missing values are either filled in or removed to maintain data integrity.

• Feature Scaling: We employ normalization to ensure that all our features contribute equally to our model's training.

• Feature Selection: Redundant and irrelevant features are removed through correlation analysis.

• Balancing the Dataset: The UNSW-NB15 dataset exhibits class imbalance, which may bias machine learning models toward majority classes and reduce the detection performance for minority attack categories. To address this issue, Random Undersampling was applied to the majority class during the training phase to achieve a more balanced class distribution. The undersampling process was performed exclusively on the training dataset, while the validation and test datasets retained their original class distributions to ensure an unbiased assessment of model performance under realistic network traffic conditions. This strategy improves the classifier's ability to learn decision boundaries for minority classes while avoiding the generation of synthetic samples that may introduce additional bias into the learning process (He, 2009). Random undersampling was implemented using the RandomUnderSampler algorithm to ensure a reproducible and consistent balancing procedure prior to model training.

To improve reproducibility, feature selection was performed by combining correlation analysis with variance thresholding. Features exhibiting pairwise correlation coefficients greater than 0.90 were considered redundant, while features with variance below 0.01 were excluded due to their limited discriminatory power. The resulting feature subset was subsequently used throughout all experiments, ensuring consistency during model training, evaluation, and explainability analysis.

For readability, several dataset variables are referred to using descriptive names throughout the manuscript. Specifically, the official UNSW-NB15 feature dur is described as flow duration, while packet- and byte-related variables are discussed using descriptive terminology that reflects their operational interpretation. Unless otherwise stated, these descriptive labels correspond directly to the original variables contained in the publicly released UNSW-NB15 dataset.

As illustrated in Figure 1, the pre-processing workflow systematically prepares the UNSW-NB15 dataset by addressing missing values, normalizing feature scales, and removing redundant attributes. This ensures that all variables contribute equally to model training and mitigates data bias.

Figure 1

3.3.3 . Experimental configuration

To ensure reproducibility, the dataset was split into 70% training and 30% testing sets, using a fixed random seed of 42. The Random Forest model was configured with 100 trees and a maximum depth of 20. The Support Vector Machine (SVM) utilized a radial basis function (RBF) kernel with a regularization parameter of C = 1.0.

Feature selection was performed to improve model performance while maintaining interpretability. Pairwise correlation analysis was first applied to identify redundant attributes, and features with correlation coefficients greater than 0.90 were removed. Subsequently, low-variance features (variance < 0.01) were excluded to eliminate attributes contributing minimal discriminatory information. The resulting feature subset was used consistently across all machine learning models and experimental conditions, thereby ensuring a fair comparison and improving the reproducibility of the evaluation.

3.3.4 XAI-guided intervention protocol

To operationalise explainability within the intrusion detection workflow, an Explainability-as-Intervention (XAI²) protocol is implemented. This protocol translates explanation outputs into actionable model adjustments. The process consists of the following steps:

• Generate feature importance scores using SHAP.

• Identify the most influential features contributing to model predictions.

• Adjust the classification threshold based on explanation insights:

  • Baseline threshold: 0.5

  • Intervention threshold: optimized use of validation data

• Re-evaluate model performance after applying the adjustments.

This structured intervention enables a controlled comparison between baseline and explanation-guided conditions, allowing attribution of performance changes to explainability-driven decisions.

3.3.5 Bias and fairness evaluation

Bias was evaluated by comparing false positive rates across different attack categories. A statistical significance test (e.g., chi-square test) was conducted, and no significant disparity was observed (p > 0.05), indicating that the model maintains consistent performance across categories.

3.4 Research tools and technologies

This research makes use of advanced programming tools and machine learning packages for data pre-processing, building models, and interpretability. The study is implemented in Python, given its extensive ecosystem of machine learning and data science libraries. Table 2 summarizes the core programming tools and frameworks employed in the study. Python and its associated libraries (such as Scikit-learn, LIME, and SHAP) provide an integrated environment for model development, evaluation, and interpretability.

3.5 Reproducibility details

Model hyperparameters were selected using grid search and fixed across experiments to ensure reproducibility. Specifically:

• Random Forest: 100 trees, max depth = 20

• Decision Tree: max depth = 15

• SVM: RBF kernel, C = 1.0

Feature selection removed 12 highly correlated variables (correlation threshold > 0.85), including redundant packet and byte-count features. A complete list is provided in Appendix A. All experiments were conducted with a fixed random seed (42) to ensure consistency.

To further enhance reproducibility, hyperparameter optimization was conducted using grid search in conjunction with stratified 5-fold cross-validation. The optimal parameter configuration was selected based on validation performance and subsequently fixed for all comparative experiments. Identical preprocessing procedures, feature subsets, data partitions, and evaluation protocols were maintained across all models to ensure that observed performance differences resulted solely from model behavior and explanation-guided intervention rather than inconsistencies in experimental configuration.

3.6 Machine learning models

The study evaluates three machine learning models for network intrusion detection:

• Random Forest (RF)—Chosen for its high accuracy and built-in interpretability.

• Decision Tree (DT)—Provides a simple, white-box model but is prone to overfitting.

• Support Vector Machine (SVM)—Suitable for high-dimensional classification tasks but lacks transparency.

SVM was included as a baseline classifier due to its widespread use in intrusion detection literature, enabling comparative benchmarking despite its relatively lower performance in this study. Each model is trained on 70% of the dataset and tested on 30%. The following evaluation metrics are used:

• Accuracy: Measures the overall correctness of predictions.

• Precision: Indicates how many detected intrusions were threats.

• Recall (sensitivity): Measures how well the model detects actual threats.

• F1-score: Harmonic mean of precision and recall for balanced evaluation.

As shown in Table 3, the study employs four standard metrics—accuracy, precision, recall, and F1-score—to evaluate the performance of each machine learning model, ensuring a balanced assessment of detection capability and error rate.

The dataset was divided into a 70/30 training-testing ratio to ensure that most data supported model learning while retaining sufficient unseen samples for reliable evaluation. Additionally, 5-fold cross-validation was employed to validate the model's robustness and prevent overfitting, ensuring that results were generalisable across different data partitions.

3.7 Explainability as a controlled factor

To isolate the effect of explainability, we define three experimental conditions using identical data splits, pre-processing, and model hyperparameters:

• C0 (No-XAI baseline): Train and evaluate the classifier using the standard pipeline; no explanation artifacts are generated, and no analyst- or rule-driven changes are allowed.

• C1 (XAI–observe only): Generate LIME/SHAP explanations for the same trained model as C0, but do not alter thresholds, features, or alerting logic. This condition tests whether explanations alone change measured detection performance (they should not).

• C2 (XAI–intervention): Use explanations to perform preregistered intervention steps: (a) explanation- guided threshold calibration for high-attribution benign regimes; (b) feature-group aggregation for highly correlated byte/packet features; and (c) triage rule refinement for known false-positive patterns. Performance changes from C1 → C2 are attributed to explainability-driven decisions, not to model retraining differences.

To preserve methodological validity, explanation-guided intervention was applied only after completion of model training and performance evaluation. SHAP and LIME explanations were interpreted using predefined operational rules to support threshold calibration and alert refinement without modifying the learned model parameters. Consequently, any observed performance improvements are attributable to explanation-guided operational decision support rather than retraining or structural changes to the underlying machine learning model.

3.8 Explainability using XAI techniques

To enhance model interpretability, two XAI techniques are applied:

3.8.1 Local explanations with LIME

LIME generates localized explanations by approximating black-box models with interpretable linear models. It helps answer:

• Why was a specific network event classified as an attack?

• Which features had the strongest influence on that decision?

Figure 2 visualizes the local interpretability generated by LIME. The plot highlights the specific network features (for instance, “dst bytes” and “flow duration”) that influenced individual classification outcomes, enabling analysts to verify whether the model's reasoning aligns with expert expectations.

Figure 2

3.8.2 Global feature importance with SHAP

SHAP assigns Shapley values to each feature, quantifying its impact on model predictions. It helps security analysts understand:

• Which network attributes are most critical for intrusion detection?

• How does modifying input data affect model decisions?

As evident from Figure 3, SHAP analysis reveals the global influence of each feature on model predictions. “dst bytes,” “src bytes,” and “tot pkts” emerge as dominant contributors, indicating that traffic volume and packet count are critical in distinguishing normal from malicious behavior.

Figure 3

3.9 Risk assessment

Cybersecurity research involves various risks. To mitigate these risks, the following strategies are adopted:

Table 4 outlines potential research risks and corresponding mitigation strategies. Notably, overfitting and data-privacy concerns were addressed through cross-validation and anonymization, ensuring methodological reliability and ethical compliance.

3.10 Bias evaluation

Bias assessment was conducted by evaluating model performance across different traffic classes and attack categories. Disparities in false-positive and false-negative rates were analyzed to ensure that no specific class was disproportionately misclassified. This analysis confirmed that the model maintained balanced detection performance across categories.

3.11 Ethical considerations

This research follows strict ethical guidelines to ensure:

• Data privacy: The dataset is anonymised to protect sensitive information.

• Transparency: Findings are clearly documented to promote accountability in AI-based cybersecurity.

• Fairness: The models are tested for potential bias to ensure fairness in detection.

The research aims to perform a study that not only improves knowledge in cybersecurity and XAI but also shows a dedication to integrity, accountability, and the wellbeing of stakeholders and the larger society by abiding by these ethical principles. These moral precepts serve as the foundation for the research's methodology and enhance the study's overall validity and rigor. The next section presents experimental results and findings, evaluating how XAI enhances cybersecurity model performance, interpretability, and decision-making.

4 Results and findings

The results and findings were obtained from training, testing, and evaluating the Explainable AI (XAI)-based network intrusion detection model. The objective of this study is not only to assess the performance of machine learning models in detecting cyber threats but also to examine how explainability techniques (LIME & SHAP) enhance cybersecurity interpretability. The results are organized into:

• Descriptive statistics of the dataset—Examining the distribution and characteristics of network traffic data.

• Machine learning model performance—Intrusion detection using Random Forest (RF), Decision Tree (DT), and Support Vector Machine (SVM) compared.

• Explainability analysis using LIME & SHAP—Evaluation of how explanation outputs support the proposed simulated analyst-informed intervention framework for interpreting AI-generated intrusion alerts.

• Discussion of primary findings—Comprehension of how explainability facilitates better cybersecurity decisions.

Figure 4 exhibits the experimental workflow, which begins with pre-processing the UNSW-NB15 dataset, followed by training machine learning models, including Random Forest (RF), Decision Tree (DT), and Support Vector Machine (SVM). Model performance is evaluated using metrics such as accuracy, after which Explainable AI (XAI) techniques—specifically LIME and SHAP—are applied to interpret predictions, ultimately yielding enhanced cybersecurity insights.

Figure 4

4.1 Dataset analysis and descriptive statistics

Before evaluating machine learning models, initial data analysis (EDA) is conducted to understand the dataset structure, identify outliers, and recognize distributions of features. The UNSW-NB15 dataset consists of mixed benign and malicious network flows for various types of cyberattacks.

In this study, model performance was primarily evaluated using accuracy, precision, recall, and F1-score because these metrics are widely adopted for intrusion detection and provide complementary perspectives on classification effectiveness, particularly under class-imbalanced conditions. While additional evaluation measures such as Receiver Operating Characteristic–Area Under the Curve (ROC-AUC), Precision–Recall Area Under the Curve (PR-AUC), confusion matrices, and per-attack-category performance can provide further insight into classifier behavior, they were beyond the scope of the current experimental evaluation. These metrics will be incorporated in future work to enable a more comprehensive assessment of detection capability across different attack scenarios.

4.1.1 Dataset composition

The dataset comprises 49 network traffic features, categorized under:

• Flow-based features: Connection duration, packet counts, protocol types.

• Content-based features: Number of source/destination bytes transferred.

• Time-based features: Connection frequency patterns.

• Attack labels: Indicates whether a traffic instance is normal or malicious.

4.1.2 Class distribution

An important factor in dataset analysis is recognizing the proportion between regular and malicious traffic. Unbalanced datasets have the potential to skew machine learning models and thus result in greater false positives or false negatives. As shown in Table 5, normal traffic constitutes roughly two-thirds of the dataset, highlighting a moderate class imbalance that justifies the use of sampling and balancing techniques during model training.

The class distribution presented in Table 5 corresponds to the processed experimental dataset used in this study after data integration and preprocessing rather than the original publicly distributed UNSW-NB15 files. The preprocessing pipeline included dataset consolidation, removal of incomplete records, feature filtering, and class balancing as described in Section 3.3.2. Consequently, the reported sample counts differ from those of the original benchmark release while preserving the original attack labels and feature definitions.

4.1.3 Feature correlation analysis

A correlation heatmap was generated to identify correlations between different network features. Features showing strong correlations (redundant data) were filtered to ensure no data bias in model training. Figure 5 depicts inter-feature correlations within the dataset. Highly correlated variables were filtered to prevent redundancy and multicollinearity, thereby improving model generalisability.

Figure 5

4.2 Machine learning model performance

Three machine learning models were compared in network intrusion detection:

• Random Forest (RF)—Ensemble methodology for strong and interpretable models.

• Decision Tree (DT)—A white-box model with explicit decision routes but subject to overfitting.

• Support Vector Machine (SVM)—A widely used classifier for high-dimensional data, included here as a baseline for comparative evaluation.

4.2.1 Model accuracy comparison

Each model was trained on 70% of the dataset and tested on 30%. Table 6 presents the comparative results across models. Random Forest attains an accuracy of 95.3 per cent, outperforming Decision Tree and SVM, and is consequently selected for subsequent XAI analysis.

4.2.2 Model comparison and selection

• Random Forest yielded the optimal result (accuracy of 95.3%), and therefore, is the most effective model for detecting intrusions.

• Decision Tree performed well but showed signs of overfitting, making it less suitable for real-world applications.

• SVM struggled with the dataset size and feature complexity, yielding the lowest accuracy (72.5%).

Based on these results, Random Forest was selected as the final model for explainability analysis using LIME and SHAP.

4.3 Explainability analysis using LIME and SHAP

SHAP and LIME highlight influential features; their value lies not only in visualization but in enabling actionable insights. For example, consistent attribution of high importance to traffic volume features suggests that model sensitivity to legitimate high-throughput connections may lead to false positives. This insight directly informed threshold adjustments, demonstrating how interpretability can translate into operational improvements.

While Random Forest achieved high accuracy, its decisions remained opaque, necessitating the use of XAI techniques to improve interpretability.

SHAP visualizations revealed that “dst bytes,” “flow duration,” and “src bytes” consistently had the strongest positive contributions to threat prediction, indicating that abnormal packet size and connection duration were dominant attack indicators. LIME plots illustrated case-level variations, allowing analysts to distinguish misclassified benign connections. These patterns confirm that XAI techniques effectively expose model reasoning and facilitate targeted policy refinement.

Although the Explainability-as-Intervention (XAI²) framework conceptually distinguishes baseline (C0), observation (C1), and intervention (C2) conditions, the present study reports the overall operational outcome following implementation of the explanation-guided intervention protocol rather than separate quantitative performance metrics for each experimental condition. A comprehensive controlled evaluation comparing C0, C1, and C2 independently constitutes an important direction for future work.

4.3.1 Local interpretability using LIME

LIME (Local Interpretable Model-Agnostic Explanations) was applied to generate explanations for specific predictions. The results revealed:

• The most influential features in classifying network intrusions were ”dst bytes” (destination byte size), ”src bytes” (source byte size), and ”flow duration.”

• False positives were often linked to short-duration but high-volume connections, indicating potential misclassification.

In Figure 6, the LIME visualization demonstrates how the model assigns higher importance to abnormal byte transfers and short-duration connections, offering transparency into specific attack classifications.

Figure 6

4.4 Key findings

To strengthen cybersecurity protocols using Explainable Artificial Intelligence (XAI) in computer networks, the study conducts a thorough examination.

4.4.1 Accuracy vs. explainability trade-Off

While Random Forest produced the best accuracy, it did take XAI strategies (SHAP & LIME) to make it interpretable. Without interpretability, AI alerts might fail to command the trust of cybersecurity professionals.

4.4.2 Clarifying analysts

In this study, “analysts” refer to a simulated expert-driven evaluation protocol, where explanation outputs were systematically interpreted using predefined rules reflecting standard cybersecurity practices. These include threshold adjustment, anomaly pattern recognition, and validation of model predictions against domain knowledge.

4.4.3 Security analysts' use of XAI insights

The integration of XAI techniques enables a structured interpretation of model predictions, supporting more informed and consistent decision-making within cybersecurity workflows. Rather than relying solely on model outputs, analysts can utilize explanation artifacts to examine the key features influencing each classification and assess whether the prediction aligns with expected network behavior. In this study, SHAP and LIME explanations revealed that features related to traffic volume and connection duration (e.g., dst bytes, src bytes, and flow duration) consistently contributed to intrusion predictions. By analyzing these patterns, analysts were able to identify cases where legitimate high-throughput traffic was incorrectly flagged as malicious, highlighting a systematic source of false positives.

These insights were operationalised through predefined intervention steps, including threshold adjustment and refinement of alerting rules. For example, connections characterized by high data transfer, but normal behavioral patterns were re-evaluated under adjusted thresholds, reducing unnecessary alerts without compromising detection performance. This process demonstrates that XAI contributes to decision-making not by altering the model directly, but by enabling evidence-based adjustments to classification criteria and response strategies. As a result, analysts can validate model behavior, reduce false positives, and improve the reliability of intrusion detection systems in practical settings.

4.4.4 Implications for real-world cybersecurity deployment

The findings of this study highlight that explainability plays a critical role in bridging the gap between high-performing machine learning models and their practical deployment in cybersecurity environments. While models such as Random Forest achieve strong detection accuracy, their operational effectiveness depends on whether their decisions can be interpreted, validated, and acted upon by security analysts. The integration of XAI techniques enables this transition by providing structured insights into model behavior. In particular, the identification of key features driving intrusion predictions supports targeted refinement of detection strategies, such as threshold calibration and rule adjustment. This is especially important in reducing false positives, which are a major barrier to the adoption of AI-based intrusion detection systems in real-world settings.

Furthermore, the use of explanation-guided interventions demonstrates how interpretability can be incorporated into existing security workflows without requiring changes to the underlying model architecture. Instead, explainability acts as a decision-support layer, allowing organizations to enhance model reliability while maintaining performance. From an operational perspective, this approach supports improved trust, auditability, and compliance with regulatory requirements. By making AI-driven decisions transparent and justifiable, XAI-enabled systems are better suited for deployment in critical infrastructure, enterprise networks, and training environments where accountability and reliability are essential.

This section included a description of experimental results, model evaluation, and interpretability analysis. The following were discovered:

• Random Forest yielded the best result (95.3%) for detecting intrusions.

• LIME provided local explanations for AI decisions, enabling them to identify false positives.

• SHAP identified global influential factors, strengthening trust in AI-driven alerts by security professionals.

The next section will discuss the broader impact of such discoveries, describing how XAI can redefine models of cybersecurity, strengthen decision-making, and build trust in AI-driven security practices.

5 Analysis and discussion

The findings in this research offer crucial insights into how Explainable Artificial Intelligence (XAI) can advance cybersecurity systems by optimizing threat detection and interpretability of models. The debate in this chapter is on three major aspects:

• Evaluating model interpretability and performance—Comparison between machine learning models' capability to identify intrusions and their interpretability.

• Implications for Cybersecurity Professionals—How Explainable AI models improve human-AI collaboration in cybersecurity practices.

• Research significance and innovativeness—The greater impact of understandable AI on trust, choice, and application in daily life.

5.1 Evaluating model performance and explainability

The Research Findings' technical foundations for improved cybersecurity via Explainable Artificial Intelligence (XAI) in computer networks offer a thorough grasp of the research's contributions to strengthening network security measures by breaking down the technological subtleties.

5.1.1 Performance trade-offs in AI-powered intrusion detection

One of our goals in this study is to compare several machine learning models in their ability to identify malicious network behavior. Among models under consideration, such as Random Forest (RF), Decision Tree (DT), and Support Vector Machine (SVM), Random Forest proved to have better performance in accuracy (95.3%), confirming its robustness in network intrusion detection.

The key takeaway from this comparison is that high-performing models (such as Random Forest) often lack inherent interpretability, necessitating the use of XAI techniques. Decision Trees, although more interpretable, suffered from overfitting and performed suboptimally in real-world scenarios.

5.1.2 How XAI improves AI decision transparency

The integration of LIME and SHAP significantly enhances the transparency of AI-driven intrusion detection systems by providing interpretable representations of model behavior at both local and global levels. Rather than treating model outputs as opaque predictions, these techniques enable a detailed examination of the features influencing each classification.

LIME supports local interpretability by explaining individual predictions, allowing analysts to understand why a specific network event is classified as malicious. This is particularly useful for investigating anomalous cases and identifying potential misclassifications. In contrast, SHAP provides a global view of feature importance, highlighting consistent patterns across the dataset and revealing which network attributes most strongly influence model decisions.

Together, these techniques improve the interpretability of AI systems by linking model outputs to meaningful feature contributions. This enables analysts to validate alerts, identify sources of error such as false positives, and refine detection strategies based on evidence rather than intuition. As a result, explainability strengthens trust in AI-driven systems and supports more reliable and accountable cybersecurity decision-making.

As indicated in Figure 7, LIME clarifies the reasoning behind a flagged intrusion by ranking the contributing features. This allows human analysts to validate or override automated alerts more confidently.

Figure 7

5.2 Evaluating model performance and explainability

The findings of the research lead to the following recommendations for the application and use of XAI techniques in cybersecurity:

5.2.1 Enhancing human-AI collaboration in cybersecurity

The proposed Explainability-as-Intervention (XAI²) framework demonstrates how explainability can support analyst-informed cybersecurity workflows through a simulated operational protocol. Explanation outputs generated by SHAP and LIME provide transparent evidence that can be incorporated into predefined intervention rules for alert validation, threshold calibration, and false-positive reduction. Recent studies further indicate that explainable AI improves cybersecurity decision-making by providing transparent and actionable explanations that enhance analyst confidence, facilitate threat investigation, and support accountable AI-assisted security operations (Prasad et al., 2026).

Figure 8 illustrates the proposed simulated analyst-informed workflow, in which explanation outputs are translated into predefined operational intervention rules. The feedback loop represents the conceptual integration of explainability into cybersecurity operations and is intended to demonstrate the operational role of explainability rather than depict an experimentally validated human-participant study.

Figure 8

5.2.2 False positive clarification

The proposed Explainability-as-Intervention (XAI²) framework reduced the observed false-positive rate from 18% to 6% under the experimental conditions considered in this study. These results demonstrate the potential of explanation-guided operational decision support to improve intrusion detection performance by refining alert thresholds and reducing unnecessary alerts. However, the reported results correspond to the adopted experimental configuration and should be interpreted within the scope of the evaluated dataset and models. Additional statistical validation through repeated experiments, confidence interval estimation, and robustness analysis across multiple datasets would further strengthen the generalizability of these findings and is identified as an important direction for future research.

5.2.3 Reducing false positives and bias in AI-based security models

One of the biggest challenges in cybersecurity AI is false positives, where legitimate network activity is mistakenly flagged as malicious.

• Without XAI: AI-generated intrusion alerts provide limited transparency, making operational validation and threshold refinement more difficult.

• With XAI: Explainability techniques reveal the feature contributions underlying each prediction, enabling the proposed simulated intervention protocol to identify systematic false-positive patterns and support evidence-based threshold calibration.

By applying SHAP, this study found that certain high-traffic legitimate connections were wrongly classified as attacks due to their byte size and duration. Understanding these patterns enables the fine-tuning of AI models, minimizing disruptions in security operations. Table 7 shows a marked reduction in false positives after the introduction of XAI. The overall false-positive rate dropped from 18 per cent to 6 per cent, illustrating the tangible benefit of explainability in operational contexts.

Although explanation-guided threshold calibration reduced the observed false-positive rate, the present study did not include an independent comparison with conventional threshold tuning performed without explainability. Consequently, the individual contribution of explainability beyond threshold adjustment alone cannot be isolated experimentally. In addition, recall was not evaluated separately before and after threshold calibration, preventing a direct assessment of the trade-off between reducing false positives and maintaining detection sensitivity. Future work will therefore include controlled comparisons between explanation-guided and conventional calibration strategies, together with comprehensive reporting of precision, recall, F1-score, and false-positive rate across all experimental conditions to quantify the incremental benefit of explainability.

5.2.4 Computational considerations for explainability

Although SHAP and LIME substantially improve model transparency and support explainability-guided decision-making, both methods introduce additional computational overhead compared with conventional black-box inference. SHAP computes feature contributions by estimating marginal effects across multiple feature combinations, whereas LIME generates local surrogate models for individual predictions. Consequently, explanation generation requires additional processing beyond standard classification. In the present study, explainability was applied during the post-classification analysis stage rather than during model training, thereby avoiding any impact on the learning process. For operational deployment, explanation generation may be selectively applied to high-risk or uncertain predictions to balance interpretability with computational efficiency.

5.2.5 Reliability and robustness of explainability

Although SHAP and LIME provide valuable insights into the reasoning of machine learning models, the reliability of explanation methods has become an increasingly important research topic in explainable artificial intelligence (Milani et al., 2022; Papastergiou et al., 2026). Previous studies have shown that local explanation techniques such as LIME may produce different explanations for the same prediction under different sampling conditions, while SHAP values may become less stable when highly correlated features are present (Milani et al., 2022). Furthermore, recent research has highlighted the need to evaluate explanation robustness against input perturbations, feature perturbations, and adversarial manipulation, particularly in security-critical applications where trustworthy decision support is essential (Milani et al., 2022; Papastergiou et al., 2026).

The objective of the present study was to evaluate explainability as an operational intervention mechanism for improving intrusion detection performance rather than to benchmark the robustness of individual explanation algorithms. Consequently, explanation consistency, perturbation robustness, feature-attribution stability, and adversarial robustness were not experimentally evaluated. Nevertheless, these aspects represent important directions for future research, particularly for operational deployment in Security Operations Centers (SOCs), where reliable explanations are essential for maintaining analyst trust, supporting trustworthy AI-assisted cybersecurity decision-making, and enabling transparent cyber-risk management (Papastergiou et al., 2026).

5.3 Research significance and innovation

This research makes a significant contribution to cybersecurity and AI explainability by:

5.3.1 Advancing cybersecurity AI from black box to transparent systems

Traditional AI-driven cybersecurity models prioritize accuracy but lack transparency. This study proves that XAI models can achieve both high accuracy and interpretability, making them viable for real-world deployment.

5.3.2 Enabling trustworthy AI for regulatory and compliance needs

As data privacy regulations (e.g., GDPR, CCPA) evolve, AI-driven security tools must justify their decisions. XAI provides a framework for ensuring AI-driven cybersecurity aligns with ethical and legal requirements.

5.3.3 Innovation in threat intelligence and automated security systems

By integrating XAI techniques with machine learning models, this research pioneers a transparent approach to AI-powered threat detection, offering a framework that can be adapted to:

• Enterprise cybersecurity (e.g., AI-powered SIEM systems).

• Government defense systems (e.g., AI-enhanced national security monitoring).

• Cloud security (e.g., detecting anomalies in cloud-based networks).

5.4 Implications for policy and organizational strategy

The integration of XAI into cybersecurity policy frameworks promotes transparency and accountability, aligning with regulatory standards such as GDPR and NIS2. For critical infrastructure and government systems, explainable intrusion detection ensures that automated alerts can be audited and justified, supporting risk governance and incident response accountability. Organizations can leverage XAI-driven dashboards to enhance situational awareness and workforce trust in AI-assisted decision-making.

6 Conclusions

This study demonstrates that integrating explainability into intrusion detection workflows enables more interpretable and actionable cybersecurity decisions. While Random Forest achieved the highest detection performance, the incorporation of XAI techniques provided additional insight into model behavior, supporting explanation-guided interventions such as threshold calibration and rule refinement. Rather than acting as a direct performance enhancer, explainability contributes by enabling informed adjustments, such as threshold calibration and rule refinement, improving operational decision-making in cybersecurity systems.

Table 8 summarizes the study's key findings and their practical implications, highlighting the role of explainability in improving trust and operational effectiveness. As shown, the false positive rate decreases from 18% to 6% under XAI-guided intervention.

Note: The 18% falsepositive rate corresponds to the baseline classification using the default decision threshold (0.5) before any intervention. The reduced value of 6% is obtained after applying XAI-guided threshold calibration, reflecting the impact of explanation-driven adjustments on model performance.

6.1 Contributions and future research directions

This study provides a framework for integrating explainable AI models into cybersecurity. However, there are still areas that require further exploration:

6.1.1 Contributions

This study presents an Explainability-as-Intervention (XAI²) framework that integrates explainable artificial intelligence with machine learning-based intrusion detection to address the longstanding trade-off between predictive performance and model transparency in cybersecurity. By incorporating explanation outputs generated by SHAP and LIME into a simulated analyst-informed operational workflow, the proposed framework demonstrates how explainability can support structured, transparent, and evidence-based cybersecurity decision-making. The framework evaluates this workflow through predefined intervention rules, providing a practical foundation for future validation with professional Security Operations Center (SOC) analysts.

Beyond improving model interpretability, the proposed approach transforms explainability into an operational decision-support mechanism by enabling explanation-guided intervention during intrusion detection. The integration of feature importance analysis provides actionable insights into attack patterns, facilitating more effective threat intelligence, false-positive reduction, and proactive cyber-defense strategies. Rather than evaluating the robustness of explanation algorithms themselves, this study investigates how explanation outputs can be systematically incorporated into operational cybersecurity workflows, thereby complementing existing research on explanation quality while addressing the practical use of explainable AI in security operations.

This contribution complements recent advances in explainable cloud intrusion detection, SHAP-guided ensemble learning, explainable IoT security, cybersecurity decision support, and explainability-based cyber-risk management (Goncalves and Alomari, 2026; Melendrez et al., 2025; Khan et al., 2026; Prasad et al., 2026; Papastergiou et al., 2026). Unlike existing studies, however, the proposed XAI² framework explicitly evaluates explanation-guided operational intervention as a controlled component of the intrusion detection workflow, thereby extending explainable AI from post-hoc model interpretation toward actionable operational decision support in cybersecurity.

6.1.2 Future research opportunities

Although the proposed Explainability-as-Intervention (XAI²) framework demonstrated consistent improvements under the adopted experimental protocol, several opportunities remain for extending and validating the proposed approach. First, future studies should strengthen the statistical rigor of the evaluation by conducting repeated experiments using multiple random seeds, estimating confidence intervals, and performing appropriate statistical significance tests to further establish the robustness and reproducibility of the reported results. In addition, validating the framework across multiple benchmark intrusion detection datasets and real-world Security Operations Center (SOC) environments would improve its generalisability and practical applicability.

A second important direction involves expanding the performance evaluation beyond the standard classification metrics used in this study. While accuracy, precision, recall, and F1-score provide a comprehensive assessment of classification performance, future work should incorporate additional evaluation measures, including ROC-AUC, PR-AUC, confusion matrices, per-attack-category performance analysis, computational overhead, training and inference time, explainability execution cost, and scalability under large-scale and real-time deployment scenarios. Such analyses would provide a more complete understanding of the trade-offs between predictive performance, computational efficiency, and operational explainability.

Furthermore, although SHAP and LIME successfully enhanced the transparency of the proposed intrusion detection framework, the stability and reliability of the generated explanations were not explicitly investigated. Future research should evaluate explanation consistency across repeated executions, feature-attribution stability under correlated features, robustness to input perturbations, and resistance to adversarial manipulation using established explanation-quality evaluation frameworks. Such investigations would strengthen confidence in explainability-guided decision support, particularly in security-critical operational environments where reliable explanations are essential for analyst trust and effective incident response.

Finally, future research should explore the integration of advanced deep learning architectures and modern ensemble learning techniques with explainable AI to improve the detection of increasingly sophisticated cyber threats. Additional investigations into real-time explainability, adaptive explanation generation, and human-centered validation with professional cybersecurity analysts would further enhance the practical deployment of explainable intrusion detection systems. Moreover, continued research on fairness, bias mitigation, and trustworthy AI governance will be essential for ensuring that explainability-driven cybersecurity solutions remain transparent, reliable, and accountable in evolving operational environments.

6.1.3 Final thoughts

Future research ought to consider the incorporation of XAI with deep reinforcement learning (DRL) to come up with an adaptive intrusion response system that can deal with real-time threat mitigation. Further studies would investigate how to use multi-modal explainability, that is, visual, textual, and statistical explanations, to improve interpretability between technical and policy stakeholders.

References

• 1

  AdakB. P.ShuklaN.AlamriA. (2022). Unboxing deep learning model of food delivery service reviews using explainable artificial intelligence (XAI) technique. Foods11:2019. doi: 10.3390/foods11142019

  • Pubmed Abstract
  • CrossRef
  • Google Scholar
  • View reference in article

• 2

  AhmedG. J.PiccialliF. (2022). From artificial intelligence to explainable artificial intelligence in industry 4.0: a survey on what, how, and where. IEEE Trans. Industr. Inform.18, 5031–5042. doi: 10.1109/TII.2022.3146552

  • CrossRef
  • Google Scholar
  • View reference in article

• 3

  AliS.AbuhmedT.El-SappaghS.MuhammadK.Alonso-MoralJ. M.CalfalonieriR.et al. (2023). Explainable Artificial Intelligence (XAI): what we know and what is left to attain Trustworthy Artificial Intelligence. Inform. Fus.99:101805. doi: 10.1016/j.inffus.2023.101805

  • CrossRef
  • Google Scholar
  • View reference in article

• 4

  AntoniadiM.DuY. Guendouz, Y.WeiL.MazoC.BeckerB. A.et al. (2021). Current challenges and future opportunities for XAI in machine learning- based clinical decision support systems: a systematic review. Appl. Sci.11:5088. doi: 10.3390/app11115088

  • CrossRef
  • Google Scholar
  • View reference in article

• 5

  ArshadM.OnnC. W.AhmadA.MogweG. (2025). Big data analytics and AI as success factors for online video streaming platforms. Front Big Data8:1513027. doi: 10.3389/fdata.2025.1513027

  • Pubmed Abstract
  • CrossRef
  • Google Scholar
  • View reference in article

• 6

  AslamN.KhanI. U.MirzaS.AlOwayedA.AnisM. A.AljuaidR. M.et al. (2022). Interpretable machine learning models for malicious domains detection using explainable artificial intelligence (XAI). Sustainability14:7375. doi: 10.3390/su14127375

  • CrossRef
  • Google Scholar
  • View reference in article

• 7

  BoatengE. Y.OtooJ.AbayeD. A. (2020). Basic tenets of classification algorithms K-nearest-neighbor, support vector machine, random forest and neural network: a review. J. Data Anal. Inform. Process.8, 341–357. doi: 10.4236/jdaip.2020.84020

  • CrossRef
  • Google Scholar
  • View reference in article

• 8

  CapuanoN.FenzaG.LoiaV.StanzioneC. (2022). Explainable artificial intelligence in cybersecurity: a survey. IEEE Access10, 93575–93600. doi: 10.1109/ACCESS.2022.3204171

  • CrossRef
  • Google Scholar
  • View reference in article

• 9

  ChamolaV.HassijaV.SulthanaA. R.GhoshD.DhingraD.SikdarB. (2023). A review of trustworthy and explainable artificial intelligence (XAI). IEEE Access11, 78994–79015. doi: 10.1109/ACCESS.2023.3294569

  • CrossRef
  • Google Scholar
  • View reference in article

• 10

  Cybercrime Statistics (2025). Available online at: https://surfshark.com/research/cybercrime-risks/statistics (Accessed February 26, 2025).

  • Google Scholar
  • View reference in article

• 11

  de SousaI.Maria Bernardes Rebuzzi VellascoM.da SilvaE. (2019). Local interpretable model- agnostic explanations for classification of lymph node metastases. Sensors19:2969. doi: 10.3390/s19132969

  • Pubmed Abstract
  • CrossRef
  • Google Scholar
  • View reference in article

• 12

  der VeldenB. H.KuijfH. J.GilhuijsK. G.ViergeverM. A. (2022). Explainable artificial intelligence (XAI) in deep learning-based medical image analysis. Med. Image Anal.79:102470. doi: 10.1016/j.media.2022.102470

  • Pubmed Abstract
  • CrossRef
  • Google Scholar
  • View reference in article

• 13

  GoncalvesH.AlomariZ. (2026). “Explainable AI for cloud intrusion detection: a user study of SHAP and LIME in AWS GuardDuty,” in 2026 IEEE 5th international conference on AI in cybersecurity (ICAIC) (IEEE), 1–8. doi: 10.1109/ICAIC67076.2026.11395766

  • CrossRef
  • Google Scholar
  • View reference in article

• 14

  HariharanS.Rejimol RobinsonR. R.PrasadR. R.ThomasC.BalakrishnanN. (2023). XAI for intrusion detection system: comparing explanations based on global and local scope. J. Comput. Virol. Hack. Techn.19, 217–239. doi: 10.1007/s11416-022-00441-2

  • CrossRef
  • Google Scholar
  • View reference in article

• 15

  HeH. (2009). Learning from imbalanced data. IEEE Trans. Knowl. Data Eng.21, 1263–1284. doi: 10.1109/TKDE.2008.239

  • CrossRef
  • Google Scholar
  • View reference in article

• 16

  HulsenT. (2023). Explainable Artificial Intelligence (XAI): concepts and challenges in healthcare. AI4, 652–666. doi: 10.3390/ai4030034

  • CrossRef
  • Google Scholar
  • View reference in article

• 17

  IlyasQ. M.MehmoodA.AhmadA.AhmadM. A. (2022). Systematic study on a customer's next-items recommendation techniques. Sustainability14:7175. doi: 10.3390/su14127175

  • CrossRef
  • Google Scholar
  • View reference in article

• 18

  KhanF. M.ZebA.RahmanT.Al-KhasawnehM. A.DaradkehY. I.SiddiquiI. F.et al. (2026). XAI-driven data mining for self-defending IoT systems: enhancing cybersecurity transparency in the age of smart cities. Cogn. Comput.18:16. doi: 10.1007/s12559-026-10559-w

  • CrossRef
  • Google Scholar
  • View reference in article

• 19

  KökI.OkayF. Y.MuyanlıÖ.ÖzdemirS. (2023). Explainable artificial intelligence (xai) for internet of things: a survey. IEEE Internet Things J.10, 14764–14779. doi: 10.1109/JIOT.2023.3287678

  • CrossRef
  • Google Scholar
  • View reference in article

• 20

  LiZ. (2022). Extracting spatial effects from machine learning model using local interpretation method: an example of SHAP and XGBoost. Comput. Environ. Urban Syst.96:101845. doi: 10.1016/j.compenvurbsys.2022.101845

  • CrossRef
  • Google Scholar
  • View reference in article

• 21

  LundbergH.MowlaA. I.AbedinS. F.TharK.MahmoodA.GidlundM. (2022). Experimental analysis of trustworthy in-vehicle intrusion detection system using eXplainable Artificial Intelligence (XAI). IEEE Access10, 102831–102841. doi: 10.1109/ACCESS.2022.3208573

  • CrossRef
  • Google Scholar
  • View reference in article

• 22

  MachlevR.HeistreneL.PerlM.LevyK. Y.BelikovJ.MannorS.et al. (2022). Explainable Artificial Intelligence (XAI) techniques for energy and power systems: review, challenges and opportunities. Energy AI9:100169. doi: 10.1016/j.egyai.2022.100169

  • CrossRef
  • Google Scholar
  • View reference in article

• 23

  MelendrezA.GoncalvesH.AlomariZ.ShaoY. (2025). “Boosted ensemble voting for intrusion detection: a SHAP-driven analysis of XGBoost and CatBoost,” in 2026 IEEE international conference on service operations and logistics, informatics (SOLI) (IEEE), 25–32. doi: 10.1109/SOLI66289.2025.11396139

  • CrossRef
  • Google Scholar
  • View reference in article

• 24

  MilaniS.Tanuwidjaja H. C.AyoubiS.GimenezP.-F.HanY.JmilaH.et al. (2022). Explainable artificial intelligence for cybersecurity: a literature survey. Ann. Telecommun.77, 789–808. doi: 10.1007/s12243-022-00926-7

  • CrossRef
  • Google Scholar
  • View reference in article

• 25

  MishraA.MorisettyR. (2022). Determination of the Ultimate Tensile Strength (UTS) of friction stir welded similar AA6061 joints by using supervised machine learning based algorithms. Manuf. Lett.32, 83–86. doi: 10.1016/j.mfglet.2022.04.003

  • CrossRef
  • Google Scholar
  • View reference in article

• 26

  MohammedA. M.HussainA.AbdulkareemM. O.Mohd yunusN. Z.JamaludinN.MahmoudM.et al. (2025). Explainable artificial intelligence for predicting the compressive strength of soil and ground granulated blast furnace slag mixtures. Results Eng.25:103637. doi: 10.1016/j.rineng.2024.103637

  • CrossRef
  • Google Scholar
  • View reference in article

• 27

  MutalibN. H. A.SabriA. Q. M.WahabA. W. A.AbdullahE. R. M. F.AlDahoulN. (2024). Explainable deep learning approach for advanced persistent threats (APTs) detection in cybersecurity: a review. Artif. Intell. Rev. 57:297. doi: 10.1007/s10462-024-10890-4

  • CrossRef
  • Google Scholar
  • View reference in article

• 28

  OwensE.SheehanB.MullinsM.CunneenM.ResselJ.CastignaniG.et al. (2022). Explainable artificial intelligence (XAI) in insurance. Risks10:230. doi: 10.3390/risks10120230

  • CrossRef
  • Google Scholar
  • View reference in article

• 29

  PapastergiouS.BasheerN.LampropoulosK.VerriosP.IslamS. (2026). Explainable AI based dynamic cybersecurity risk management for cyber insurability. Int J Inform Security25:36. doi: 10.1007/s10207-025-01189-8

  • CrossRef
  • Google Scholar
  • View reference in article

• 30

  PatraS. S.JenaO. P.KumarG.PramanikS.MisraC.SinghK. N.et al. (2021). “Random forest algorithm in imbalance genomics classification,” in Data Analytics in Bioinformatics: A Machine Learning Perspective (IEEE), 173–190. doi: 10.1002/9781119785620.ch7

  • CrossRef
  • Google Scholar
  • View reference in article

• 31

  PrasadP. W. C.SayeedM. S.NguyenD.-M.HutabaratD. P.MohiuddinG. M. (2026). Explainable AI: enhancing decision-making in the detection of cyber threats. Front. Comput. Sci.8:1762332. doi: 10.3389/fcomp.2026.1762332

  • CrossRef
  • Google Scholar
  • View reference in article

• 32

  RjoubG.BentaharJ.WahabO. A.MizouniR.SongA.CohenR.et al. (2023). A survey on explainable artificial intelligence for network cybersecurity. arXiv Preprint arXiv:2303.12942. doi: 10.48550/arXiv.2303.12942

  • CrossRef
  • Google Scholar
  • View reference in article

• 33

  SarkerI. H.JanickeH.MohsinA.GillA. (2024). Explainable AI for cybersecurity automation, intelligence and trustworthiness in digital twin: methods, taxonomy. Challenges and prospects. ICT Express10, 935–958. doi: 10.1016/j.icte.2024.05.007

  • CrossRef
  • Google Scholar
  • View reference in article

• 34

  SharmaA.RaniS.ShabazM. (2025). A comprehensive review of explainable AI in cybersecurity: Decoding the black box. ICT Express. doi: 10.1016/j.icte.2025.10.004

  • CrossRef
  • Google Scholar
  • View reference in article

• 35

  SpeithT. (2022). “A review of taxonomies of explainable artificial intelligence (XAI) methods,” in Proceedings of the (2022) ACM conference on fairness, accountability, and transparency (ACM), 2239–2250. doi: 10.1145/3531146.3534639

  • CrossRef
  • Google Scholar
  • View reference in article

• 36

  SudarK. M.NagarajP.NithisaaS.AishwaryaR.AakashM.LakshmiS. I.et al. (2022). “Alzheimer's disease analysis using Explainable Artificial Intelligence (XAI),” in 2022 International conference on sustainable computing and data communication systems (ICSCDS) (IEEE), 419–423. doi: 10.1109/ICSCDS53736.2022.9760858

  • CrossRef
  • Google Scholar
  • View reference in article

• 37

  SuriH. (2020). “Ethical considerations of conducting systematic reviews in educational research,” in Systematic Reviews in Educational Research, eds. O. Zawacki-Richter, M. Kerres, S. Bedenlier, M. Bond, and K. Buntins (Wiesbaden: Springer), 41. Available online at: https://library.oapen.org/bitstream/handle/20.500.12657/23142/1007012.pdf?s

  • Google Scholar
  • View reference in article

• 38

  XuY.LiL.TangY.ChenZ.ChanC. K. (2025). “Design of electrical safety monitoring system for university laboratories based on digital twins,” in 2025 Asia-Europe conference on cybersecurity, internet of things and soft computing (CITSC) (IEEE), 521–524. doi: 10.1109/CITSC64390.2025.00100

  • CrossRef
  • Google Scholar
  • View reference in article