# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 1 Introduction  
In recent years, connected technologies such as the Internet of Things (IoT), 5G communication, and smart grids have rapidly developed. These advancements have fundamentally transformed how industries and individuals interact with the digital world. This expansion has resulted in an exponential increase in the number of connected devices and the complexity of communication networks, providing significant benefits but also amplifying the scope of security risks [1, 2, 3]. As cyber attacks continue to rise globally, impacting sectors from finance to healthcare, addressing these threats has become a critical concern for researchers and security professionals. Ensuring robust cybersecurity is essential not only for protecting sensitive data but also for maintaining trust in these advancing technologies [4]. As of 2024, a total of 1,187,441,064 malware samples have been identified, with more than 9 million new samples emerging each month, according to the AV-TEST daily report [5]. The institute registers over 300,000 new malware samples daily. Over the past five years,malware activity has risen significantly, increasing from 647,920,244 samples in 2019 to over one billion by September 2024. Figure 1 illustrates the annual growth in malware from 2008 to 2024. Intrusion Detection Systems (IDSs) play a central role in safeguarding networks and computer systems from such threats [6]. Traditionally, IDS have been effective in monitoring network traffic and host activities to identify potential attacks [7]. However, the increasing sophistication of cyber attacks, particularly zero-day exploits and low-frequency attacks, presents new challenges that conventional IDS struggle to address. Recent research has focused on leveraging machine learning (ML) and deep learning (DL) techniques to enhance IDS capabilities [8; 9; 10; 11]. These approaches offer the potential to detect threats with greater accuracy and scalability than traditional methods, revolutionizing the field of cybersecurity. DL models have shown promising results in IDS for network traffic classification and their accuracy in detecting cyber attacks and potential threats has been thoroughly demonstrated in previous research [1; 12; 13; 14]. Some of the most effective DL models are Long Short-Term Memory (LSTM): a special Recurrent Neural Network (RNN) efficient in the processing of time-series sequential data with long-term dependencies [15; 16], Convolutional Neural Network (CNN): effective in capturing spatial relationships and particularly useful for extracting features from raw data [16; 17], and AutoEncoder (AE): learns the underlying structure of input data and is used for feature extraction and anomaly detection in IDS applications [18]. [PERSON] and [PERSON] [19] used Artificial Neural Networks (ANNs) and stacked autoencoders (SAEs) to detect impersonation attacks, achieving an 85% detection rate with a 2.36% false alarm rate on the AWID dataset. Later, they improved performance to a 92% detection rate with a 4.4% false alarm rate by incorporating two cascading encoders with k-means clustering [8]. [PERSON] et al. [10] proposed an unsupervised Non-symmetric Deep AutoEncoder (NDAE) combined with Random Forest (RF) for feature extraction and classification, achieving 97.9% accuracy on KDD Cup99 and 85.4% on NSL-KDD datasets, though with poor results for U2R and R2L attacks that did not surpass 9.5%. [PERSON] and [PERSON]'s Stacked Sparse AutoEncoder (SSAE) paired with SVM achieved a 99.3% accuracy and improved detection rates for low-frequency attacks on NSL-KDD [20]. [PERSON] et al. [21] proposed a scalable deep neural network (DNN) framework that outperformed traditional machine learning models for intrusion detection across multiple datasets, with up to 91% accuracy on ADFA-Linux. [PERSON] et al.