Explainable Artificial Intelligence for Cyber Security Threat Detection: Improving Transparency and Trust in AI-based Intrusion Detection Systems

  • Authors

    • Sunny Dhabhai Cyber Resilience & Crisis Leadership, ESILV, France. Author

    DOI:

    https://doi.org/10.67228/30713315/IJAIDT-V9I3P105

    Published 07-14-2026

  • Explainable Artificial Intelligence, Cybersecurity, Intrusion Detection Systems, Machine Learning, Deep Learning, Interpretability, Trust

    Issue

    Vol. 9 No. 3 (2026)

    Section

    Articles

  • Abstract

    The increasing adoption of artificial intelligence and deep learning in cybersecurity has significantly improved the ability of intrusion detection systems to identify complex and previously unseen network threats. However, many high-performing AI-based intrusion detection models operate as black boxes, making their decisions difficult for security analysts to interpret, validate, and trust. This study examines the role of Explainable Artificial Intelligence (XAI) in improving the transparency, interpretability, and trustworthiness of AI-driven intrusion detection systems. A structured comparative analysis of 30 foundational and domain-specific studies published between 2009 and 2022 was conducted, covering machine learning-based intrusion detection, deep learning approaches, cybersecurity datasets, interpretability methods, and XAI applications in intrusion detection. Particular attention was given to Local Interpretable Model-Agnostic Explanations, SHAP, decision trees, feature-importance techniques, surrogate models, and human-centered explanation approaches. The analysis indicates that XAI can support security analysts by clarifying the factors influencing threat classifications, improving model validation, exposing spurious correlations, and facilitating more informed incident-response decisions. Nevertheless, important challenges remain, including explanation instability, computational overhead, adversarial manipulation, limited standardization of explainability metrics, and differences in stakeholder interpretation needs. The study proposes a multidimensional evaluation perspective that considers predictive performance, fidelity, stability, comprehensibility, efficiency, robustness, and trust calibration. The findings emphasize that explainability should be integrated into intrusion detection design as a core cybersecurity requirement rather than treated as an optional post-processing feature.

  • References

    [1] Lipton, Z. C. (2018). The mythos of model interpretability. Communications of the ACM, 61(10), 36-43.

    [2] Miller, T. (2019). Explanation in artificial intelligence: Insights from the social sciences. Artificial intelligence, 267, 1-38.

    [3] Ribeiro, M. T., Singh, S., & Guestrin, C. (2016, August). " Why should i trust you?" Explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining (pp. 1135-1144).

    [4] Potla, R. (2023). Designing a BTP-centric integration mesh for shop-floor IoT, MES and ERP in discrete manufacturing. Journal of Artificial Intelligence, Machine Learning and Data Science, 1(2), 1-8.

    [5] Lundberg, S. M., & Lee, S. I. (2017). A unified approach to interpreting model predictions. Advances in neural information processing systems, 30.

    [6] Rudin, C. (2019). Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead. Nature machine intelligence, 1(5), 206-215.

    [7] Arrieta, A. B., Díaz-Rodríguez, N., Del Ser, J., Bennetot, A., Tabik, S., Barbado, A., ... & Herrera, F. (2020). Explainable Artificial Intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI. Information fusion, 58, 82-115.

    [8] Adadi, A., & Berrada, M. (2018). Peeking inside the black-box: a survey on explainable artificial intelligence (XAI). IEEE access, 6, 52138-52160.

    [9] Guidotti, R., Monreale, A., Ruggieri, S., Turini, F., Giannotti, F., & Pedreschi, D. (2018). A survey of methods for explaining black box models. ACM computing surveys (CSUR), 51(5), 1-42.

    [10] Potla, R. B. (2024). A SOX/ITAR-aligned global ERP template for multi-plant manufacturers: Governance patterns and controls. J Artif Intell Mach Learn & Data Sci, 2(2), 3222-3232.

    [11] Jadala, S. K. (2026). Data-Centric Security for Generative AI Systems: Protecting Sensitive Data against Leakage, Inference Attacks, and Unauthorized Model Access. International Journal of Data Engineering and Intelligent Computing, 9(3), 01-32.

    [12] Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009, July). A detailed analysis of the KDD CUP 99 data set. In 2009 IEEE symposium on computational intelligence for security and defense applications (pp. 1-6). Ieee.

    [13] Buczak, A. L., & Guven, E. (2015). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications surveys & tutorials, 18(2), 1153-1176.

    [14] Moustafa, N., & Slay, J. (2015, November). UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In 2015 military communications and information systems conference (MilCIS) (pp. 1-6). Ieee.

    [15] Liao, H. J., Lin, C. H. R., Lin, Y. C., & Tung, K. Y. (2013). Intrusion detection system: A comprehensive review. Journal of network and computer applications, 36(1), 16-24.

    [16] Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009). Anomaly-based network intrusion detection: Techniques, systems and challenges. computers & security, 28(1-2), 18-28.

    [17] Gilpin, L. H., Bau, D., Yuan, B. Z., Bajwa, A., Specter, M., & Kagal, L. (2018, October). Explaining explanations: An overview of interpretability of machine learning. In 2018 IEEE 5th International Conference on data science and advanced analytics (DSAA) (pp. 80-89). IEEE.

    [18] Yin, C., Zhu, Y., Fei, J., & He, X. (2017). A deep learning approach for intrusion detection using recurrent neural networks. IEEE access, 5, 21954-21961.

    [19] Shone, N., Ngoc, T. N., Phai, V. D., & Shi, Q. (2018). A deep learning approach to network intrusion detection. IEEE transactions on emerging topics in computational intelligence, 2(1), 41-50.

    [20] Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., & Venkatraman, S. (2019). Deep learning approach for intelligent intrusion detection system. IEEE access, 7, 41525-41550.

    [21] Ferrag, M. A., Maglaras, L., Moschoyiannis, S., & Janicke, H. (2020). Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study. Journal of Information Security and Applications, 50, 102419.

    [22] Mirsky, Y., Doitshman, T., Elovici, Y., & Shabtai, A. (2018). Kitsune: An ensemble of autoencoders for online network intrusion detection. arXiv preprint arXiv:1802.09089.

    [23] Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019). Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity, 2(1), 20.

    [24] Aldweesh, A., Derhab, A., & Emam, A. Z. (2020). Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues. Knowledge-Based Systems, 189, 105124.

    [25] Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Hotho, A. (2019). A survey of network-based intrusion detection data sets. Computers & security, 86, 147-167.

    [26] Wang, M., Zheng, K., Yang, Y., & Wang, X. (2020). An explainable machine learning framework for intrusion detection systems. IEEE access, 8, 73127-73141.

    [27] Mahbooba, B., Timilsina, M., Sahal, R., & Serrano, M. (2021). Explainable artificial intelligence (XAI) to enhance trust management in intrusion detection systems using decision tree model. Complexity, 2021(1), 6634811.

    [28] Marino, D. L., Wickramasinghe, C. S., & Manic, M. (2018, October). An adversarial approach for explainable ai in intrusion detection systems. In IECON 2018-44th Annual Conference of the IEEE Industrial Electronics Society (pp. 3237-3243). IEEE.

    [29] Amarasinghe, K., & Manic, M. (2018, October). Improving user trust on deep neural networks based intrusion detection systems. In IECON 2018-44th Annual Conference of the IEEE Industrial Electronics Society (pp. 3262-3268). IEEE.

    [30] Potla, R. B. (2024). Optimizing extended warehouse management for make-to-order plants: Slotting, wave picking, and yard orchestration at scale. Journal of Computer Science and Technology Studies, 6(3), 181-192.

    [31] Jadala, S. K. (2025). Ransomware Resilience in Cloud and Enterprise Systems: Detection, Response, and Recovery Frameworks. Journal of Cyber-Physical Security and Robotics, 1(02), 63-86.

    [32] Zhang, Z., Al Hamadi, H., Damiani, E., Yeun, C. Y., & Taher, F. (2022). Explainable artificial intelligence applications in cyber security: State-of-the-art in research. IEEe Access, 10, 93104-93139.

    [33] Neupane, S., Ables, J., Anderson, W., Mittal, S., Rahimi, S., Banicescu, I., & Seale, M. (2022). Explainable intrusion detection systems (x-ids): A survey of current methods, challenges, and opportunities. IEEE Access, 10, 112392-112415.

    [34] Jadala, S. K. (2024). Zero Trust Architecture and Identity Threat Detection for Securing Cloud, IoT, and Hybrid Enterprise Systems. International Journal of Humanities and Information Technology, 6(04), 141-185.

    [35] Charmet, F., Tanuwidjaja, H. C., Ayoubi, S., Gimenez, P. F., Han, Y., Jmila, H., ... & Zhang, Z. (2022). Explainable artificial intelligence for cybersecurity: a literature survey. Annals of Telecommunications, 77(11), 789-812.

    [36] Carvalho, D. V., Pereira, E. M., & Cardoso, J. S. (2019). Machine learning interpretability: A survey on methods and metrics. Electronics, 8(8), 832.

  • Downloads