# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 3 Results
### X12S-IDS Results  
With the trained models, X12S-IDS was ready for testing and classification. All testing records are passed to the binary classifier first. Whenever the classifier marks a record as an attack, it is sent to the multi-class classifier for further classification into the attack type. Meanwhile, global SHAP explanations of the binary classifier are available for system experts. A prediction set is created in the testing phase. All records classified as normal are saved in the predictions set as a \(-1\) value, while all abnormal classifications are passed to the multi-class classifier. The latter's predictions are saved in the prediction set with values  
Figure 17: UNSW-NB15 CM of the BI-LSTM model without SMOTE. Figure 18: UNSW-NB15 CM of the BI-LSTM model with SMOTE. ranging from 0 to 8 for the 9 attack classes of the UNSW-NB15 dataset and from 0 to 13 for the 14 classes of attacks of the CICIDS2017 dataset. When evaluating all test records, each prediction value is adjusted to correctly assign the class label for normal records, which were initially marked as \(-1\). This adjustment aligns the predicted values with the true attack classes in the test set, ensuring the framework is properly assessed and accurate metric percentages can be generated. The pseudocode of the classification part for the UNSW-NB15 dataset is shown in Algorithm 1. To evaluate the 2-stage IDS, a benchmark was created by training the same layers of the chosen BI-LSTM network on the full dataset similar to traditional 1-stage classification techniques. The results are compared together for both CICIDS2017 and UNSW-NB15 datasets as shown in Figures 19-22. ```
0: records \(R\in Test\) Data
0: Binary classifier BC, Multiclass classifier MC
0: empty list \(PRED\)
1:for all\(r\in R\)do
2: class \(\Leftarrow BC(r)\)
3:if class is 1 then
4: attack \(\Leftarrow MC(r)\)
5:\(PRED\Leftarrow attack\)
6:else
7:\(PRED\Leftarrow-1\)
8:endif
9:endfor
10:for all\(p\in PRED\)do
11:if\(p\geq 6\)then
12:\(p=p+1\)
13:endif
14:endfor
15:for all\(p\in PRED\)do
16:if\(p\) is \(-1\)then
17:\(p=6\)
18:endif
19:endfor
```  
**Algorithm 1** Classify Test Records. Figure 21: CM of 2-stage IDS on the UNSW-NB15 dataset. Figure 22: CM of 1-stage IDS on the UNSW-NB15 dataset. Figure 20: CM of 1-stage IDS on the CICIDS2017 dataset. Comparing the two confusion matrices of the CICIDS2017 dataset, it is clear that 2-stage IDS outperforms traditional 1-stage classification. The framework's 2-stage model is better at correctly identifying benign traffic. It also can handle low-frequency attack classes, such as Web Attack-XSS and Web Attack-Brute Force, better. The accuracy of the 2-stage framework is slightly higher than the traditional 1-stage IDS (0.9981 vs. 0.9945). The same conclusion is reached for the UNSW-NB15 dataset. The framework's 2-stage model is better at correctly identifying benign traffic as well as handling low-frequency attack classes, such as Worms, Shellcode, Analysis, and Backdoor. The framework's accuracy is slightly higher (0.9774 vs. 0.9754). Detailed results of the framework vs. the benchmark on both datasets are shown in Tables 6 and 7. The primary observation of the detailed results is that the 2-stage model generally outperforms the 1-stage model across multiple metrics, especially for low-frequency attack types where detection is more challenging. For the CICIDS2017 dataset, the 2-stage model performs significantly better in classes such as Bot and DoS Slowhttptest, where it achieves higher F1-scores compared to the 1-stage model. For instance, the 2-stage model achieves an F1-score of 0.76 for bot detection, compared to 0.63 for the 1-stage model, showing a marked improvement in handling precision-recall trade-offs. Similarly, for DoS Slowhttptest, the F1-score of 0.97 for the 2-stage model highlights superior classification accuracy. The 2-stage model also performs better on rare or difficult-to-detect classes like Web Attack-Brute Force and Infiltration, which are missed entirely by the 1-stage model.