## 4 Results and Discussion
### Discussion  
The results of this study demonstrate the effectiveness of the proposed ensemble intrusion detection system, which combines the strengths of ANN, SVM, and RF within a real-time, explainable framework. To assess the contribution of each component in the proposed ensemble, we evaluated the individual performance of ANN and SVM classifiers independently prior to integration. The ANN model achieved an accuracy of 99.20%, while the SVM achieved 96.80%. When combined in the ensemble architecture with RF as the meta-classifier, the accuracy improved to 99.40%. This improvement illustrates that each  
Figure 14: Anomaly detection results from the AWS-hosted Flask app. base learner contributes complementary strengths, and the ensemble effectively captures their collective predictive power, thereby justifying the architectural design. With an overall accuracy of 99.40%, the ensemble model outperformed the individual classifiers and surpassed the accuracy levels reported in several related studies using the same NSL-KDD dataset. Notably, this performance was achieved while maintaining interpretability through SHAP and real-time responsiveness via a cloud-hosted Flask interface, features that are often lacking in existing academic and commercial IDS models. Although the current system operates as a binary classifier (normal vs. anomaly), it can be extended to a multiclass intrusion detection framework by utilizing the detailed attack-type labels present in both the NSL-KDD and UNSW-NB15 datasets. Such an extension would enable the identification of specific attack types (e.g., DoS and probe), further enhancing the model's practical applicability. However, this would involve additional challenges such as handling class imbalance and retraining the ensemble model for multi-output classification, where we have identified this as a promising direction for future work. In comparison to traditional signature-based or rule-based intrusion detection systems, the proposed model offers significant advantages in adaptability, scalability, and transparency. Most commercial IDS solutions either rely on static threat intelligence or lack explainability in their detection processes, which limits their effectiveness in detecting zero-day or polymorphic attacks and reduces the trust of human analysts. In contrast, this study's approach integrates live packet analysis and machine learning with explainable AI to provide not only accurate predictions but also clear justifications for each decision, enhancing user confidence and operational efficiency. Despite its promising results, the current implementation has a few limitations. First, the system is designed primarily for binary classification (normal vs. anomalous traffic) and does not yet distinguish between different types of attacks. Second, while the deployment on a t2.medium EC2 instance was sufficient for research purposes, larger-scale or enterprise-level implementations may require higher resource configurations to handle heavier network loads and parallel user access. While the current deployment on an AWS t2.medium instance validated the system's real-time functionality and detection accuracy, the evaluation did not include systematic stress testing under high-volume traffic conditions. In future work, we plan to conduct performance benchmarking using simulated traffic bursts and continuous high-throughput streams to measure system response times, model inference latency, and resource utilization. This will provide a more comprehensive understanding of the framework's scalability in production-grade environments. Finally, although SHAP explanations offer interpretability, there remains a need for automated prioritization of alerts and integration with security incident and event management (SIEM) tools to streamline incident response in practical environments.