A SHAP-Based Explainable AI Approach for Intrusion Detection Models

The ever-increasing sophistication of cyber attacks, coupled with the increasing complexity of modern network systems, have created an urgent need for robust and adaptive intrusion detection systems (IDS). Traditional machine learning-based IDS, although achieving impressive accuracy, are often limited by their “black box” characteristics and lack of transparency, which makes it difficult to explain results and build trust among cybersecurity experts. This paper proposes the application of the SHAP (SHapley Additive Explanations) technique to build an explainable artificial intelligence (XAI) model for IDS on the UNSW-NB15 standard dataset. Through experiments, the model is trained and analyzed to accurately identify the features that have the greatest impact on the prediction results. The results of using SHAP technique are compared with a recent study using the Occlusion Sensitivity (OS) technique, showing that SHAP provides good support in reducing the number of features while maintaining high accuracy and providing clear, stable, and practically meaningful interpretations.