Loading article...
Loading article...
Stream/Area:
-
Subject:
-
Paper ID:
IJSREM62362
Volume:
10 |
5 |
May 2026
Pages:
1-5
Publication Frequency:
Monthly (12 issues per year)
License:International Journal of Scientific Research in Engineering and Management follows the Creative Commons Attribution 4.0 (CC BY 4.0) License, allowing free use and distribution with proper attribution.
Department Of Computer Science Engineering
B . S . Abdur Rahman Crescent Institute Of Science And Technology
Department Of Computer Science Engineering
B . S . Abdur Rahman Crescent Institute Of Science And Technology
Department Of Computer Science Engineering
B . S . Abdur Rahman Crescent Institute Of Science And Technology
Department Of Computer Science Engineering
B . S . Abdur Rahman Crescent Institute Of Science And Technology
Department Of Computer Science Engineering
B . S . Abdur Rahman Crescent Institute Of Science And Technology
Every day, millions of users click download links without knowing whether the file waiting on the other end is safe. Existing browser security tools tend to step in too late—warning users only after a file has already landed on their device, and even then, rarely explaining why the file was flagged. This paper introduces a system designed to change that. We built an AI-Based Download Intrusion Detection System that watches for download link clicks in real time and steps in before a single byte is transferred. At its core sits a Random Forest classifier trained on the UNSW-NB15 network dataset, achieving 95.67% detection accuracy and a ROC AUC of 0.9823. What makes this system different is not just that it detects threats—it explains them. Using TreeSHAP, every security decision comes with a clear, plain-language explanation of exactly which signals raised the alarm. These explanations are backed by five independent analysis layers: machine learning scoring, URL reputation checks, static file inspection, live URLhaus threat intelligence, and Shannon entropy analysis—all fused into a single risk score. Every decision is also mapped to the MITRE ATT&CK framework, giving analysts immediate operational context. The system lives inside a Chrome extension with a ten-page Streamlit dashboard behind it. All eight test cases produced the correct outcome.
KEYWORDS
We built a browser security system that acts before harm is done and explains itself clearly when it acts. The system intercepts download link clicks before any transfer begins, analyzes them across five independent layers, and returns a plain-language explanation powered by TreeSHAP within milliseconds. The Random Forest model achieves 95.67% accuracy on UNSW-NB15, beating L-XAIDS [6] by over ten percentage points. Every decision is grounded in live threat intelligence and mapped to MITRE ATT&CK. All eight test cases passed. The system demonstrates that the gap between academic IDS research and practical browser security is fully closeable.
[1] A. Alzubaidi et al., “Explainable AI applications in cyber security,” ACM Computing Surveys, vol. 55, no. 8, pp. 1–36, 2023. [2] O. Arreche et al., “E-XAI: Evaluating black-box explainable AI frameworks for network intrusion detection,” IEEE Access, vol. 12, pp. 23954–23976, 2024. [3] M. J. Hossain et al., “Explainable deep-learning framework for real-time network intrusion and malware detection,” IEEE Access, vol. 13, pp. 147640–147655, 2025. [4] R. Singh, P. Verma, and S. Patel, “ML-based risk assessment of file downloads in web browsers,” J. Cyber Security Technology, vol. 7, no. 3, pp. 185–198, 2023. [5] A. Kumar, N. Sharma, and R. Mehta, “XAI for early detection of cyber threats,” Computers & Security, vol. 129, Art. 103062, 2024. [6] A. E. Muhammad, K.-C. Yow, N. Bačanin-Džakula, and M. A. Khan, “L-XAIDS: A LIME-based XAI framework for IDS,” Cluster Computing, vol. 28, Art. 654, 2025. [7] A. Alzubaidi, M. Al-Ayyoub, and Y. Jararweh, “AI techniques and challenges in cybersecurity,” Future Gen. Computer Systems, vol. 148, pp. 200–218, 2023. [8] M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should I trust you?,” in Proc. ACM SIGKDD, 2016, pp. 1135–1144. [9] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in NeurIPS, 2017, pp. 4765–4774. [10] P. Sharma, R. Mehta, and S. Verma, “User behavior analysis of browser security warnings,” IEEE Security & Privacy, vol. 19, no. 4, pp. 48–57, 2021.
Publication Date
5/3/2026
Peer Review Type
Double-Blind Peer Review
Review Rounds: 2
Documents
Article Views
0
Total views since publication
PDF Downloads
7
Total downloads since publication
Geographic Reach
5
Digital Preservation: This article is permanently archived on Zenodo and complies with all data preservation standards across major indexing platforms.
Plagiarism Screening
This manuscript has been checked for plagiarism using TurnitinPlagiarismChecker software.
Conflict of Interest
The authors declare no conflict of interest related to this research work.
Funding Information
No funding information available for this research.
Related research in the same subject area
Loading similar articles...