# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 2 Materials and Methods  
XIZS-IDS's architecture leverages the normal and attack class imbalance that is present in the dataset. It comprises two stages powered by XAI: the first stage classifies each record as either normal or attack, providing a global explanation of the trained model, while the second stage focuses solely on classifying the attack type. The first stage utilizes a binary ML classifier to distinguish between normal packets (labeled 0) and abnormal (attack) packets (labeled 1). The second part is a DL multi-class classifier that only trains on attack records and identifies their specific types, disregarding all normal records during training. Figure 2 illustrates the architecture of XIZS-IDS.  
Nearly all available IDS datasets are imbalanced [37], with the majority consisting of normal behavior records, while the remaining portion includes various attack types. Some attack types appear at a lower frequency, referred to as low-frequency attacks, as they are rarely captured in the datasets. These low-frequency attacks present a significant challenge for existing IDSs, as they are more difficult to detect.  
In some of the related research, authors focus solely on the binary classification of dataset records, identifying normal and attack records [38; 39; 40]. Such studies achieve high accuracies; however, they conceal the challenge of identifying low-frequency attacks as it is out of scope for binary classification. In other research, authors attempted to tackle the issue of low-frequency records using multi-class classifiers; however, their results leave room for improvement.  
The two stages of the XIZS-IDS framework combine the advantages of binary classification, which distinguishes between normal and abnormal behavior, with a multi-class classifier that specifies the type of attack. By separating these tasks into distinct stages, the architecture allows the binary classifier to handle the normal vs. abnormal classification, while the multi-class classifier focuses exclusively on distinguishing between different attack types.  
Notably, in Stage II, the multi-class classifier is trained only on attack records, excluding normal records from the training dataset. This step is designed to help the multi-class model concentrate entirely on learning the distinct characteristics of various attack classes, which is particularly useful for detecting low-frequency or rare attacks that are often underrepresented in the dataset. By removing normal records, the model's ability to differentiate between attack classes is improved, as it no longer needs to balance the detection of normal traffic, which dominates the datasets due to their imbalanced nature. This targeted focus on attack instances refines the learning process, leading to a more specialized model for attack detection.  
To enhance the interpretability of the model, global SHAP explanations are provided for the trained binary model in Stage I. SHAP offers a detailed, transparent view of the model's decision-making process, revealing how each feature contributes to predictions. This approach not only improves the model's transparency but also provides a deeper  
Figure 2: General architecture of XIZS-IDS.  
understanding of the factors influencing the binary classification between normal and abnormal traffic.  
This research hypothesizes that the exclusion of normal records from the multi-class classifier's training data enhances the overall performance of the IDS. By refining the focus on attack detection, the model becomes more adept at recognizing the nuances of various attack types, improving detection accuracy, especially for low-frequency attacks. The two-stage approach, therefore, optimizes the trade-off between specialized attack detection and overall system performance.