# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 2 Materials and Methods
### Detailed Framework Workflow  
The XIZS-IDS framework operates in three key phases, which are illustrated in Figure 3. First, the system preprocesses the data to ensure consistency and feature readiness. Second, a binary classifier is applied to differentiate between normal traffic and potential attacks. Finally, a deep learning-based multi-class classifier is used to further categorize detected attack traffic into specific types. Each phase is carefully constructed to maximize detection accuracy while balancing interpretability and computational efficiency.  
In the data preprocessing phase, raw network traffic data is cleaned to remove address features and null records. This step is crucial in IDS, as irrelevant attributes can dilute the  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Attack Type** & **Description** & **Frequency (\%)** \\ \hline DoS—Slowloris & Denial of Service attack where partial HTTP & 0.20 \\  & requests are sent to exhaust server resources & 0.19 \\ DoS—slowhttptest & Denial of Service attack where partial HTTP & 0.013 \\  & requests are sent to exhaust server resources & 0.0013 \\  & Exploiting a vulnerable software to create a & 8.16 \\ DoS—Hulk & Denial of Service attack using the Hulk tool to & 0.36 \\  & generate large volumes of web traffic & 0.0004 \\ DoS—GoldenEye & Denial of Service attack using the GoldenEye & 0.0007 \\  & tool to overwhelm web servers & 0.002 \\  & Exploits a vulnerability in the Heartbeat feature & 0.0007 \\  & of OpenSSL to extract sensitive information & 0.0004 \\ Web Attack—SQLi & SQL injection attacks, targeting databases by & 0.0007 \\  & injecting malicious SQL queries & 0.0007 \\ Web Attack—XSS & Cross-Site Scripting, where malicious scripts are & 0.002 \\  & injected into web pages viewed by other users & 0.005 \\ Web & Repeated attempts to guess web & 0.005 \\ Attack—Brute & login credentials & 0.005 \\ \hline \hline \end{tabular}
\end{table}
Table 2: _Cont._  
Figure 3: Detailed architecture of the 2 stages.  
model's ability to detect attacks and unnecessarily increase computational overhead. A new feature column is introduced to represent the total number of bytes transferred in each record, as this information can be a strong indicator of anomalous behavior associated with certain attack types such as DoS attacks.  
Next, data standardization is performed using a Standard Scaler to normalize numerical features, ensuring that features with large value ranges do not dominate the learning process. This is particularly important in IDS scenarios, where network traffic data often contains a mix of high-variance and low-variance attributes. Categorical features, such as protocol types and network services, are encoded using OneHotEncoding.  
The dataset is split into training and testing sets with an 80/20 split for the binary classification stage. Additionally, a 75/25 split within the training data is used to create a validation set for the multi-class classifier, enabling hyperparameter tuning and early stopping to prevent overfitting. A third version of the dataset is also generated by removing all normal records, allowing the multi-class classifier to train exclusively on attack instances. This targeted approach ensures the model focuses on learning the distinct characteristics of various attack types, which is especially beneficial for improving detection rates of low-frequency attacks.