# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 4 Discussion  
In this paper, XI2S-IDS, an intelligent 2-stage approach to building a NIDS, has been presented. The approach makes use of the imbalance in the dataset by building a binary classifier that learns the normal behavior of users in the first stage, powered by SHAP explanations to increase trust in its decision, followed by a multi-class classifier for the second stage that only focuses on distinguishing the types of attacks as well as using SMOTE to oversample low-frequency attack records. The results of the first stage show that LinearSVC and SGD variants (log, hinge, mod. huber) show decent performance but are clearly outperformed by tree-based ensemble models, especially in terms of recall and FNR. Ensemble models, XGBoost and LightGBM, dominate in both datasets, offering the best balance between high precision, recall, and low error rates, making them the most reliable models for both datasets. Ensemble models perform better because they combine multiple Decision Trees, reducing both variance and bias. Their ability to handle complex, non-linear relationships leads to superior accuracy, recall, and F1-scores compared to simpler models. The boosting techniques used in these models allow them to iteratively learn from mistakes, making them more robust in detecting network traffic anomalies. Linear models are precise but struggle with capturing complex patterns, while basic tree-based models can overfit and affect generalization. Ensemble models mitigate these issues by improving weak learners in each iteration, resulting in better performance across metrics. LightGBM was chosen as the binary classifier of the first stage. A comparison of LightGBM binary classification results with related work is shown in Table 8 for the CICIDS2017 dataset and in Table 9 for the UNSW-NB15 dataset. The comparison clearly demonstrates LightGBM's superior performance over recent related research. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Classifier** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline J48 [53] & 99.88 & NaN & 99 & - \\ DNN 1 layer [21] & 96.3 & 90.8 & 97.3 & 93.9 \\ DBN [54] & 97.7 & 96.08 & 97.53 & 97 \\ DNN LSTM [55] & 99.55 & 99.36 & 99.44 & 99.42 \\ Proposed Model **LightGBM** & **99.9** & **99.7** & **99.7** & **99.7** \\ \hline \hline \end{tabular} Bold values indicate the best results for each evaluation criterion.  
\end{table} 
Table 8: Comparison of proposed versus related work on the CICIDS2017 dataset for binary classification. The second stage consisting of the attack-classifier highlights the correlated attacks that seem to be indistinguishable from classifiers. For example, in the CICIDS2017 dataset, the web attacks brute force and XSS seem to be tightly coupled. However, using SMOTE upsampling enhanced their classification rate. In UNSW-NB15, the Exploits attack was favored by the model when classifying different types of attacks, causing an issue in classification that was fixed using SMOTE upsampling. The detection of low-frequency attacks, a key challenge in the field, was significantly enhanced through the application of a two-stage classification process and the use of SMOTE for handling class imbalances. Comparing XIZS-IDS with the traditional benchmark of the 1-stage classifier highlighted the importance of learning normal behavior by leveraging the imbalance in the datasets. Results of the 1-stage benchmark classifier illustrate the classification of low-frequency attacks as normal records while dividing the classification into two stages effectively and correctly classifying low frequency attacks. XIZS-IDS was able to decrease the FNR of the low-frequency attack classes in both datasets as shown in Tables 10 and 11. The performance on rare attack types such as Heartbleed and Infiltration was particularly notable. As seen in Table 10, the false negative rate (FNR) for Heartbleed dropped from 100% in the 1-stage model to 20% in XIZS-IDS, while Infiltration detection improved from 100% FNR to 33%.