An Explainable Hybrid Deep Learning Framework for Network Intrusion Detection Using Feature-Guided CNN Models

Abstract

Cybersecurity risks have evolved in the linked digital terrain of today into more complex, frequent, and varied forms. Conventional intrusion detection systems sometimes find it difficult to match the new and changing assault strategies. Thus, creating an intelligent and adaptable intrusion detection system (IDS) has emerged as a key area of research interest. The goal of this work is to develop a hybrid intrusion detection system (IDS) that effectively combines machine learning and deep learning techniques to accurately identify various cyberattacks. Using the CICIDS2017 dataset, which models realistic network traffic scenarios encompassing benign and malicious activity, the main goal is to develop a model capable of great accuracy, interpretability, and robustness. We followed a thorough approach to reach this goal. First preprocessing of the dataset included label encoding, removing null and infinite values, and grouping low-representation attack classes into more general categories (such as DosFam and Brute Force), and Principal Component Analysis (PCA) helped to lower feature dimensionality; Borderline-SMOTE addressed class imbalance. XGBoost and Random Forest were used to examine feature importance; thereafter, two hybrid models—XGB+CNN and RF+CNN—were built. These models enable the collection of sequential and temporal traffic patterns by using particular attributes to train CNN classifiers. SHAP was applied for model explainability using global and local interpretation techniques, including summary plots, dependence graphs, and force plots, in order to increase transperancy. The suggested hybrid models produced really encouraging results. Strong accuracy and recall values across all attack categories let both the RF+CNN and XGB+CNN models achieve high test accuracies of 97.5. Furthermore, SHAP-based interpretability verified that important factors influencing the predictions were Destination Port, Bwd Packet Length Mean, and Fwd Packet Length Max, therefore verifying the feature selection and improving model confidence in operational settings.