# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 1 Introduction
[22] developed a model combining neural networks and autoencoders for network and host-based intrusion detection, achieving 99% accuracy in multi-class classification on NSL-KDD and 92% for host-based intrusion detection (HIDS) on ADFA  
Figure 1: Amount of malware from 2008 to August 2024 [5]. LD. [PERSON] et al. [23] used variational autoencoders (VAEs) and a generative adversarial network (WGAN-GP) to augment unbalanced datasets, increasing detection rates for low-frequency attacks. [PERSON] and [PERSON] [24] applied few-shot learning using DNN and CNN, achieving strong results for unbalanced datasets with 92% accuracy on UNSW-NB15. SwiftIDS [25] emphasized real-time intrusion detection using LightGBM [26] for parallel data processing, while [PERSON] and [PERSON] [27] combined optimized CNN and hierarchical multi-scale LSTM [28] achieving up to 96% accuracy on various datasets. [PERSON] et al. [29] shifted the perspective of IDS from reactive to proactive by redefining the UNSW-NB15 dataset into a time-series problem. The authors utilized CNN, LSTM, and attention models to forecast possible attacks and were able to achieve 85% F1-score, 90% precision, and 81% recall. [PERSON] et al. [30] proposed an ML-based IDS tailored for cyber attacks in the Internet of Vehicles (IoV). Their approach used the datasets CIC-IDS-2017, CSE-CIC-IDS-2018, and CIC-DDoS-2019 to create a unified framework capable of detecting multiple attack types. The system integrates feature selection using Random Forest Regression, data balancing techniques like SMOTE and SMOTE-ENN, and ML models, including Random Forest, XGBoost, and CatBoost, achieving 99.8% accuracy with minimized overfitting and a detection time of 0.24 s.  
Despite these advancements, several challenges remain. Key areas of concern include high false positive and false negative rates, scalability for large and complex networks, and the ability to adapt to zero-day attacks. The ability to detect abnormal patterns in real-world scenarios is essential for enabling prompt responses, regardless of the nature of the attack. Moreover, a key challenge in improving IDS performance is the issue of black box models. While DL models are highly effective, their lack of transparency raises concerns, especially when used in critical infrastructure. The need for explainability is increasingly important to ensure that security measures are not only accurate but also understandable, allowing for better trust and control in deployment. Balancing the need for accurate detection with explainability remains a significant challenge. The complexity and lack of transparency in ML and DL models have given rise to a research field called eXplainable Artificial Intelligence (XAI). Its goal is to enhance trust in black-box model decisions by providing clear explanations of their logic and reasoning [31]. Explainability is particularly critical in IDS deployed in high-stakes, real-time environments such as healthcare and finance, where rapid, transparent decision-making is essential. Unlike traditional black-box models, explainable IDS frameworks allow security analysts to trust and understand the logic behind each classification, which is indispensable for taking informed, timely actions. This demand for interpretability aligns with a broader push in cybersecurity for XAI methodologies, positioning explainable IDS as pivotal for organizations that rely on prompt responses to potential threats. XAI explanations can be global, offering a broad overview of how the model functions, or local, focusing on specific predictions. Additionally, explanation techniques are categorized as model-specific, designed for a particular learning model, or model-agnostic, which can be applied to any model regardless of its implementation. In [32], [PERSON] et al. implemented a hybrid IDS approach by combining expert-written rules with machine learning algorithms to detect and classify network attacks.