Bridging the gap: advancing the transparency and trustworthiness of network intrusion detection with explainable AI

With the explosive rise of internet usage and the development of web applications across various platforms, ensuring network and system security has become a critical concern. While machine learning (ML) and deep learning (DL) have revolutionized intrusion detection systems (IDSs), their effectiveness is hampered by a crucial limitation: opacity. These "black box" models lack human interpretability, transparency, explainability, and logical reasoning in their prediction outputs, greatly hindering mainstream adoption, confidence, and trust in these systems. This study proposes a novel XAI-based framework that integrates explanations at every stage of the machine-learning pipeline and combines local and global, intrinsic and post-hoc, and model-agnostic and model-specific explanations. We also introduce ExplainDTC, SecureForest-RFE, RationaleNet, and CNNShield architectures in network security solutions. These architectures leverage the UNSW-NB15 dataset to detect network intrusions with high accuracy and provide quantifiable, human-interpretable explanations for their decisions to build trust through explainability. To explain how a decision is made by the models, we integrate multiple XAI methods such as LIME, SHAP, ElI5, and ProtoDash on top of our architectures. The generated explanations provide quantifiable insights into the influential factors and their respective impact on network intrusion predictions. Additionally, we provide comprehensive textual explanations alongside visualizations in XAI, empowering diverse audiences with transparent, reproducible insights into model decision-making. Thus, our approach introduces more transparency, richness in explainability, trust, and effectiveness between the decisions made by our improved IDS models and the users, facilitating the path for a more secure digital future.