# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 5 Conclusions  
In this paper, we proposed XI2S-IDS, an explainable two-stage intelligent intrusion detection system designed to enhance both the accuracy and interpretability of intrusion detection in network security. XI2S-IDS effectively addresses the challenges of low-frequency attack detection. This is achieved by combining a binary classification stage with a multi-class classifier trained exclusively on attack records, resulting in improved false negative rates (FNRs) for rare attack types. XI2S-IDS integrates SHAP-based explanations, which provide valuable insights into feature importance and model behavior, enabling greater trust in automated IDS outputs. Experimental results on the UNSW-NB15 and CICIDS2017 datasets demonstrate the superior performance of XI2S-IDS compared to traditional single-stage classifiers, particularly in its handling of imbalanced attack types and low-frequency threats. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Framework** & **Accuracy** & **Precision** & **Recall** & **F1** \\ \hline XI2S-IDS & **97\%** & **98.2**\% & **97.3**\% & **97.2**\% \\ VAE [23] & 93\% & 95.2\% & 91.9\% & 93\% \\ DNN [21] & 66\% & 62\% & 66\% & 59\% \\ PSO-ACO-GA + Rotation & 91.2\% & 91.6\% & 91.3\% & NA \\ forest and bagging [39] & 89.1\% & 89.1\% & 63.2\%\% & 90.8\% \\ SAE [60] & 89.1\% & 89.1\% & 63.2\%\% & 90.8\% \\ \hline \hline \end{tabular} Bold values indicate the best results for each evaluation criterion.  
\end{table} 
Table 13: Multi-class results comparison of the XI2S-IDS and related research on the UNSW-NB15 dataset. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Framework** & **Accuracy** & **Precision** & **Recall** & **F1** \\ \hline XI2S-IDS & **99.8\%** & **99.9\%** & **99.8\%** & **99.8\%** \\ GAN RF [59] & 99.8\% & 98.6\% & 92.7\% & 95\% \\ CNN LSTM ATT [29] & 90\% & 81\% & 85\% \\ XGB [30] & 99.8\% & 99.8\% & 99.8\% & 99.8\% \\ \hline \hline \end{tabular} Bold values indicate the best results for each evaluation criterion.  
\end{table} 
Table 12: Multi-class results comparison of the XI2S-IDS and related research on the CICIDS2017 dataset. A significant challenge in developing IDS lies in the substantial class imbalance present in most available datasets [60; 61], which leads to a high FNR for low-frequency attacks. Various researchers have proposed solutions to mitigate this issue, such as generating synthetic records to balance the dataset or using only a subset of the data [24; 62; 63]. XIZS-IDS addresses this challenge by training its multi-class classifier solely on attack records and employing SMOTE oversampling to enhance the detection of rare attacks, allowing the classifier to better learn the patterns of rare attacks and achieving low FNR as shown in Tables 10 and 11. The binary classification stage plays a key role in determining the overall performance of XIZS-IDS, as it triggers the multi-class classification stage when an attack is detected. Therefore, it is essential for the binary classifier to learn normal patterns and subsequently detect any abnormal behavior regardless of the attack type. XIZS-IDS's binary classifier achieved an FNR of 0.0004 for the CICIDS2017 dataset and 0.019 for the UNSW-NB15 dataset, proving the effectiveness of the two stages in distinguishing and identifying attacks compared to related research. Another ongoing challenge in IDS is the lack of real-time evaluation environments [60]. Many studies face limitations due to resource constraints or concerns around data privacy, making it difficult to assess the practical effectiveness of IDS in live systems. Real-time testing is crucial for guiding future IDS development and ensuring systems can adapt to dynamic network conditions. Detecting zero-day attacks also remains a critical unsolved problem in the field [64; 65]. Previous studies have shown that new attacks can go undetected for an average of 312 days [66], presenting a major vulnerability for organizations.