Skip to content
DSML.KZ
Publications

Talk · IEEE International Conference on Smart Information Systems and Technologies · May 13, 2026

An Investigation of an Explainability-Driven Hybrid Model for Flow-Based Intrusion Detection

Ramin Sagandykov, Assel Mukasheva, Yunkyung Lee, Amanzholova Saule Toksanovna, Jeong Won Kang, Serik Aisulu

Assel Mukasheva
Open via DOI

Abstract

The rapid growth of cloud services, mobile computing, and IoT has increased both the volume and diversity of network flows that makes it challenging to detect intrusion in operational systems and reinforcing the need for transparent decision-making. To address these challenges, this paper proposes an explainability-driven hybrid intrusion detection pipeline to facilitate flow-level classification and to provide security analysts with useful information. Experiments are conducted on the CICIDS2017 flow dataset. After feature normalization, an autoencoder is trained to learn compact low-dimensional representations of network flows, and an XGBoost classifier is used in the learned embedding space to better separate benign from malicious traffic. The model interpretability is integrated in the system using SHapley Additive exPlanations (SHAP), which allows global feature relevance analysis, as well localized explanations for individual alerts. Experimental results demonstrate that the proposed pipeline achieves competitive performance in multi-class intrusion detection and generates compact latent representations and stable SHAP-based explanations. The explanations consistently emphasize attack-relevant flow characteristics, therefore making analyst interpretation of flow easy. The proposed pipeline supports reproducibility and practical adoption in real-world intrusion detection workflows.

Network Security and Intrusion DetectionNetwork Packet Processing and OptimizationInternet Traffic Analysis and Secure E-votingintrusion detectionexplainable AIhybrid model

More by Assel Mukasheva