# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 4 Discussion
This dramatic improvement underscores the efficacy of the 2-stage approach in focusing on low-frequency attack detection, an area where most IDS traditionally struggle. Upon further examination of the confusion matrices for both XI2S-IDS and the benchmark model, it was observed that while the benchmark model exhibited a lower FNR for certain attack classes, such as Exploit, this came at the cost of increased misclassification in other attack categories. The benchmark model tended to classify multiple unknown attacks as Exploit, which is broadly defined as any attack exploiting system vulnerabilities. While this resulted in a lower FNR for Exploit attacks, it led to higher misclassification rates for other types of attacks, including Worms, Shellcode, DoS, Backdoor, and Analysis. \begin{table}
\begin{tabular}{c c c c c c c} \hline
**CICIDS2017** & **Heartbleed** & **Infiltration** & **PortScan** & **SSH-Patator** & **Web Attack-Brute** & **Web Attack-Sql** & **Web Attack-XSS** \\ \hline XI2S-IDS & 20.00\% & 33.33\% & 3.99\% & 3.29\% & 50.16\% & 100.00\% & 32.79\% \\
1-Stage IDS & 100.00\% & 100.00\% & 13.97\% & 7.1987\% & 87.30\% & 100.00\% & 96.72\% \\ \hline \end{tabular}
\end{table} 
Table 10: FNR values of low-frequency attacks in the CICIDS2017 dataset. \begin{table}
\begin{tabular}{c c c c c} \hline
**Classifier** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline LSTM [56] & 85.8 & 79.7 & 99.4 & 88.5 \\ SKM-XGB [35] & 99.08 & **98.46** & 97.46 & 97.84 \\ DNN [57] & 99 & - & - & 98.40 \\ DNN LSTM [58] & 81 & 83.55 & 81.38 & 80.51 \\ Proposed Model **LightGBM** & **99.52** & 98.21 & **98.03** & **98.12** \\ \hline \end{tabular} Bold values indicate the best results for each evaluation criterion.  
\end{table} 
Table 9: Comparison of proposed versus related work on the UNSW-NB15 dataset for binary classification. The performance of XI2S-IDS is compared against several related research on CICIDS2017 and UNSW-NB15 datasets as shown in Table 12 and Table 13, respectively. The superior performance of XI2S-IDS is attributed to its architecture and preprocessing steps. The two-stage design ensures that the binary classifier filters normal traffic effectively, enabling the second stage to focus solely on attack classification. This division of tasks optimizes the model's learning capacity for complex and subtle patterns. The use of SMOTE for oversampling addresses the inherent class imbalance in IDS datasets, allowing the multi-class classifier to better learn patterns associated with rare attacks. While XI2S-IDS demonstrates improvements in evaluation criteria over related work, it has certain limitations. The reliance on SMOTE for oversampling addresses class imbalance but introduces the risk of overfitting, as the synthetic samples may not fully capture the intricacies of real-world attack patterns, potentially impacting the model's ability to generalize to unseen data. Furthermore, while SHAP explanations provide valuable insights into the decision-making process, their computational complexity poses a challenge for real-time deployment, particularly in high-throughput environments where processing speed is critical.