EXPLAINABLE DEEP LEARNING FOR NETWORK INTRUSION DETECTION USING AUTOENCODERS AND SHAP

Abstract

Network intrusion detection is a critical defence against the growing volume and sophistication of cyber-attacks, yet signature-based systems cannot recognise novel threats and many machine learning detectors operate as opaque black boxes that security analysts cannot trust. This paper presents an explainable deep learning framework for network intrusion detection that combines an unsupervised deep autoencoder with SHapley Additive exPlanations (SHAP). The autoencoder is trained only on normal traffic from the NSL-KDD benchmark so that it learns to reconstruct benign behaviour, and intrusions are identified as records whose reconstruction error exceeds a threshold set from the normal error distribution, which enables the detection of attacks unseen during training. The method is compared against two established anomaly detectors, Isolation Forest and One-Class SVM, across accuracy, precision, recall, F1-score, and the areas under the ROC and precision-recall curves. On the NSL-KDD test set of 22,544 records, the autoencoder achieves the highest-ranking quality with a ROC-AUC of 0.945 and a precision-recall AUC of 0.942, together with 92.3 percent precision, while the One-Class SVM attains the best fixed-threshold F1-score of 0.903. SHAP is then applied to the reconstruction-error function to attribute each detection to individual traffic features, identifying file-creation activity, host indicators, service types, and connection flags as the dominant intrusion indicators, in agreement with known attack behaviour. The framework delivers accurate anomaly detection together with transparent, feature-level explanations that support analyst trust and practical deployment.