# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 1 Introduction
The model, based on a microservices architecture, includes an anomaly detector and a dynamic rule generator, which updates its knowledge base through Decision Trees. The model was validated in a DoS attack case study. In [33], [PERSON] et al. introduced an interpretable, privacy-preserving NIDS called FEDFOREST, utilizing Federated Learning for data privacy and Gradient Boosting Decision Trees for classification. Tested on four datasets, FEDFOREST achieved accuracy scores between 67% and 89% and demonstrated the ability to detect unknown attacks by classifying them into similar categories. [PERSON] and [PERSON] [34] introduced a lightweight, explainable IDS for Software-Defined Internet of Things (SD-IoT) environments, using the Sheep Flock Optimization Algorithm-Least Absolute Shrinkage and Selection Operator (SFOA-LASSO) for feature selection to enhance model efficiency. Their system, evaluated on SD-IoT and CIC-IoT-2023 datasets, employs machine learning algorithms like Decision Tree, Random Forest, XGBoost, and MLP, with SHAP used for interpretability. Similarly, [PERSON] et al. [35] developed a robust anomaly detection system addressing class imbalance using a hybrid sampling technique combining SMOTE and K-means undersampling with XGBoost (SKM-XGB). Evaluated on NSL-KDD and UNSW-NB15 datasets, the system uses SHAP for explanations and achieves high detection accuracy, particularly excelling in imbalanced network traffic data with over 99% accuracy in binary classification. [PERSON] et al. [36] proposed a framework that utilizes an ensemble model of 3 CNN classifiers with both LIME and SHAP explanations. Using the ToN-IoT dataset for evaluation, the study demonstrates that ensemble learning effectively enhances both the accuracy and interpretability of DL-based IDSs in binary and multi-class classification tasks. In this paper, we present an eXplainable Intelligent 2-Stage Intrusion Detection System (XI2S-IDS) that combines the power of ML and DL with an emphasis on explainability. XI2S-IDS addresses the aforementioned challenges by employing a two-stage detection process: an initial binary classification model to distinguish between normal and abnormal behavior, followed by a multi-class model to categorize different types of attacks. Integrating XAI into the initial stage enables security analysts to understand why certain traffic is classified as anomalous, while the second stage is tailored to detecting low-frequency attack types. The framework seeks to not only improve detection accuracy but also provide insights into the decision-making process of the system. Detecting abnormal patterns in real-world scenarios is crucial not only for immediate response but also for ensuring that the system is robust across various attack types. This necessity reinforces the significance of the proposed two-stage approach: the binary classifier ensures immediate anomaly detection, while the second stage focuses on identifying the specific attack type, facilitating deeper analysis. Such a design supports the integration of XAI to provide meaningful, actionable insights during the first stage, aiding in the decision-making process of system experts. The contributions of this paper can be summarized as follows: First, XI2S-IDS, a two-stage framework for intrusion detection, is introduced. It leverages both binary and multi-class classification to improve detection accuracy, particularly for low-frequency attacks. Second, by incorporating SHAP-based explanations, the proposed system enhances interpretability, enabling security professionals to better understand and trust the model's decisions. The framework is evaluated on two benchmark datasets--UNSW-NB15 and CICIDS2017--and demonstrates significant improvements in both detection rates and interpretability over traditional single-stage and black-box models. The rest of this paper is organized as follows: Section 2 describes the materials and methods used, including details on the architecture, preprocessing steps, and model design of the XI2S-IDS framework.