# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 3 Results  
### Stage I: Binary Classifier Results  
The models were evaluated on several performance metrics, including accuracy, precision, recall, F1-score, FNR, and False Positive Rate (FPR). These metrics served as indicators of each model's ability to correctly classify instances of both normal and intrusive network traffic. The objective of the binary model is to detect the highest number of attack records while achieving a low FNR and maintaining a high F1-score and overall performance. Multiple classifiers were trained with a range of parameters, and the best parameters were selected for each classifier. The classifier with the best performance was chosen as the model for the binary classification stage of XI2S-IDS. Tables 4 and 5 show the results of the eight ML models on both CICIDS2017 and UNSW-NB15 datasets. For this experiment, SHAP explanations are generated for the chosen binary classifier of experiment I, LightGBM, to help in understanding the reasoning behind classifying the records as normal or attack. Figures 7 and 8 present the top 20 important features according to the model, while Figures 9 and 10 show a detailed description of the effect of each feature on the model for CICIDS2017 and UNSW-NB15 datasets, respectively. Figure 5: LightGBM confusion matrix on the CICIDS2017 dataset. Figure 6: LightGBM confusion matrix on the UNSW-NB15 dataset. In Figures 9 and 10, the SHAP values along the x-axis show the contribution of each feature to the model's output. Positive SHAP values indicate that the feature increases the prediction, possibly predicting an intrusion, while negative SHAP values decrease the prediction, possibly predicting normal traffic. The color represents the value of the feature. Red corresponds to higher feature values, while blue represents lower feature values. Figure 8: Top 20 features selected by LightGBM on the UNSW-NB15 dataset. Figure 7: Top 20 features selected by LightGBM on the CICIDS2017 dataset. trusion patterns where attackers exploit packet size anomalies and irregular flow properties to bypass traditional defenses. Packet lengths and variations, features Packet Length Std, Min Packet Length, Bwd Packet Length Std, and Bwd Packet Length Mean, suggest that anomalies in packet sizes are strong indicators of malicious traffic. Attackers often use packets of unusual sizes or highly variable packet lengths to evade detection or overwhelm the network. Flow features, such as Init_Win_bytes_backward and Init_Win_bytes_forward, represent TCP connection properties that may hint at unusual or poorly structured traffic, often linked with scanning or DOS-type attacks. Packet rates features, such as Bwd Packets/s and act_data_pkt_fwd, suggest that the rate of packet transmission and the data in forward packets are significant. High packet transmission rates may indicate attempts to flood a target, whereas low data volumes in forwarded packets might indicate reconnaissance activities. The SHAP plot of UNSW-NB15 (Figure 10) highlights key indicators such as Time-to-Live (TTL) manipulation, high data transfers, anomalous packet sizes, and unusual service requests that appear to be strong signals of potential attacks. These patterns align well with known network attack behaviors such as scanning, DoS, data exfiltration, and spoofing. TTL and state features are highly indicative of suspicious traffic in this model. Attackers often manipulate TTL values to avoid detection or maintain stealth in reconnaissance activities. Service and protocol features, such as service_dns and proto_unas, have notable impacts. DNS tunneling is a well-known technique for covert data exfiltration, and protocol anomalies often hint at unconventional or unauthorized access attempts. Traffic volume and size features, such as dload, sybytes, smeansz, and network_bytes, capture unusual volumes or packet sizes, which are key indicators of both data exfiltration and DoS-type attacks. Large packet volumes or highly irregular packet sizes are red flags in network monitoring.