Explainable Deep Neural Network for a Reliable Intrusion Detection System with Shapley Additive Explanation Method

Abstract

The escalating complexity of cyber-attacks and the severe consequences of data breaches necessitate a shift toward more advanced, yet accountable, network security infrastructures. While deep learning models offer superior performance in identifying intrusions, their inherent ”black-box” nature hinders practical adoption in critical environments where security analysts must verify alerts, justify defensive actions, and conduct forensic audits. To address this lack of transparency, this study proposes an explainable Deep Neural Network (DNN) framework for a reliable Intrusion Detection System (IDS) using the CIC-IDS2017 dataset. By integrating the Shapley Additive Explanations (SHAP) method, we bridge the gap between high-performance detection and interpretability. Our experimental results demonstrate that our minimalist DNN architecture achieves an outstanding accuracy of 99.57% and an AUC-ROC of 0.9997, maintaining high detection rates across various attack types with significantly lower computational overhead compared to complex hybrid models. Furthermore, the SHAP analysis identifies Flow IAT Std and Packet Length Variance as the most influential features, offering granular insights into the model’s reasoning. This research demonstrates that high-performance deep learning can be paired with rigorous interpretability, providing a robust and transparent solution for real-time network security monitoring.