ML-Based Network Intrusion Detection Using Ensemble Methods with SHAP Explainability

This paper presented a comprehensive, end-to-end MLbased network intrusion detection system trained and evaluated on the KDD Cup 99 benchmark. SMOTE resampling resolved a severe 28.8:1 class imbalance (Fig. 1), enabling all five classifiers to exceed 99.6% accuracy on the imbalanced test set. RF and XGBoost jointly achieved the highest performance at 99.98% accuracy and F1-score (Table V, Fig. 2), with XGBoost offering a decisive 9.4× training-time advantage. Macro-averaged ROC analysis confirmed AUC of 0.9999 for both ensemble models (Fig. 4). Confusion matrix decomposition (Fig. 3) confirmed near-perfect per-class detection post-SMOTE, with residual errors concentrated at the Normal–DoS boundary. SHAP identified src_bytes, dst_bytes, and same_srv_rate as the dominant predictive features (Fig. 5), yielding three actionable detection heuristics for security operations practitioners. The full pipeline—including trained model artefacts, SMOTE preprocessing, Flask dashboard, and Docker configuration—is            publicly  available at github.com/SANC18/ml-intrusion-detection.

[1]      R. Patil and V. Varadarajan, "Explainable artificial intelligence for intrusion detection in IoT networks," Expert Syst. Appl., vol. 216, p. 119483, 2023. [2]      T. Guidotti et al., "A survey of methods for explaining black box models," ACM Comput. Surv., vol. 51, no. 5, pp. 1–42, 2022. [3]      P. A. R. Devan and N. Khare, "An efficient XGBoostDNN-based classification model for network intrusion detection system," Neural Comput. Appl., vol. 33, pp. 12499–12514, 2021. [4]      W. Wang et al., "Malware traffic classification using convolutional neural network for representation learning," in Proc. IEEE ICOIN, 2021, pp. 712–717. [5]      Y. Liu et al., "Intrusion detection systems in the era of cloud computing: A survey," J. Inf. Secur. Appl., vol. 61, p. 102897, 2021. [6]      S. Morgan, "Cybercrime to cost the world $10.5 trillion annually by 2025," Cybercrime Magazine, 2021. [7]      B. Mahbooba et al., "Explainable artificial intelligence (XAI) to enhance trust management in intrusion detection systems," Complexity, vol. 2021, 2021. [8]      M. A. Ferrag et al., "Deep learning for cyber security intrusion detection," J. Inf. Secur. Appl., vol. 50, p. 102419, 2020. [9]      P. Vuttipittayamongkol and E. Elyan, "Neighbourhood-based undersampling for handling imbalanced and overlapped data," Inf. Sci., vol. 509, pp. 47–68, 2020. [10] A. Khraisat et al., "Survey of intrusion detection systems: techniques, datasets and challenges," Cybersecurity, vol. 2, no. 1, p. 20, 2019.