Detecting Cybersecurity Threats by Integrating Explainable AI with SHAP Interpretability and Strategic Data Sampling

Norrakith Srisumrith; Sunantha Sodsee

cs.CRFeb 22, 2026

Detecting Cybersecurity Threats by Integrating Explainable AI with SHAP Interpretability and Strategic Data Sampling

Authors: Norrakith Srisumrith, Sunantha Sodsee

Organizations: Dept. of Digital Network and Information Security Management King Mongkut’s University of Technology North Bangkok Bangkok, Thailand

Abstract

The critical need for transparent and trustworthy machine learning in cybersecurity operations drives the development of this integrated Explainable AI (XAI) framework. Our methodology addresses three fundamental challenges in deploying AI for threat detection: handling massive datasets through Strategic Sampling Methodology that preserves class distributions while enabling efficient model development; ensuring experimental rigor via Automated Data Leakage Prevention that systematically identifies and removes contaminated features; and providing operational transparency through Integrated XAI Implementation using SHAP analysis for model-agnostic interpretability across algorithms. Applied to the CIC-IDS2017 dataset, our approach maintains detection efficacy while reducing computational overhead and delivering actionable explanations for security analysts. The framework demonstrates that explainability, computational efficiency, and experimental integrity can be simultaneously achieved, providing a robust foundation for deploying trustworthy AI systems in security operations centers where decision transparency is paramount.

Figures & tables

Study	Sampling Strategy	Feature Selection	Explainability	Performance	Key Contribution
DistilXIDS (2026) [ 9 ]	✓	✓	✓	99.61%	Efficient, lightweight transformer-based language model for real-time NIDS
Gaitán-Cárdenas et al. (2023) [ 13 ]			✓	Reported*	XAI-based IDS for cloud and IoT environments
Zhou et al. (2025) [ 17 ]				Reported*	Adaptive ensemble learning for real-time attack detection
Chen et al. (2023) [ 28 ]			✓	99.80%	Hardware-accelerated real-time IDS with explainable ML
Uddin et al. (2024) [ 14 ]			✓	Reported*	Explainable transformer-based model for phishing detection
Ma et al. (2025) [ 10 ]		✓		Reported*	IoT IDS with feature selection and LLM fine-tuning

TABLE I: Comparative Analysis of Recent Cybersecurity ML Approaches

Class	Original	Sampled	Percentage	Attack Category
BENIGN	2,359,097	388,808	82.7%	Normal Traffic
DoS Hulk	231,073	34,620	7.4%	Denial of Service
DDoS	128,027	25,588	5.4%	Distributed DoS
PortScan	158,930	17,979	3.8%	Reconnaissance
DoS GoldenEye	10,293	2,105	0.4%	DoS Variant
FTP-Patator	7,938	1,169	0.2%	Brute Force

TABLE II: Dataset Class Distribution After Strategic Sampling

Validation Metric	Full Dataset	20% Sample	Difference
Distribution Similarity
Mean Packet Length (Benign)	145.7	144.9	0.55%
Mean Flow Duration (Attack)	2.31s	2.29s	0.87%
Feature Correlation Matrix Distance	–	–	0.012
Performance Consistency
XGBoost Accuracy (Binary)	99.88%	99.91%	+0.03%

TABLE III: Quantitative Validation of Strategic Sampling on CIC-IDS2017

Fig. 1: Comprehensive Experimental Framework with Integrated XAI and Multi-Split Validation

Fig. 2: Detailed XAI Integration Workflow in Security Operations

Algorithm	Split	Accuracy	F1-Macro	ROC-AUC	Training Time (s)	Prediction Speed	CV Stability
XGBoost	60-10-30	99.91%	99.72%	1.0000	33.90	324,913	0.99986 ± 0.00023
XGBoost	80-10-10	99.92%	99.70%	1.0000	47.02	338,961	0.99994 ± 0.00005
XGBoost	40-10-50	99.90%	99.60%	0.9999	14.73	683,000	0.99994 ± 0.00004
Random Forest	60-10-30	99.87%	99.63%	0.9999	80.04	16,049	0.99975 ± 0.00026
Logistic Regression	60-10-30	96.34%	74.50%	0.9895	415.51	3,423,922	0.98241 ± 0.00154

TABLE IV: Multi-Configuration Algorithm Performance Analysis

Method	Features	Accuracy	F1-Macro	ROC-AUC	Training Time (s)	Reduction	Performance Gain
MRMR_70%	34	99.92%	99.77%	0.9999	21.47	30.6%	+0.05% F1
Chi2_70%	34	99.91%	99.72%	1.0000	12.29	30.6%	+0.00% F1
Original	49	99.91%	99.72%	1.0000	33.90	0%	Baseline
MRMR_50%	24	99.89%	99.61%	1.0000	16.20	51.0%	-0.11% F1
Chi2_50%	24	99.91%	99.72%	1.0000	12.28	51.0%	+0.00% F1
MRMR_30%	14	99.72%	98.66%	0.9999	23.89	71.4%	-1.06% F1

TABLE V: Comprehensive Feature Selection Performance

Metric	Performance
Accuracy	99.92%
F1-Macro	99.77%
F1-Weighted	99.92%
Precision-Macro	99.70%
Recall-Macro	99.85%
ROC-AUC	99.997%

TABLE VI: Final Optimal Configuration Performance

Fig. 3: Confusion Matrix Analysis for Optimal Configuration (XGBoost + MRMR_70% + 60-10-30)

Fig. 4: Comprehensive ROC Analysis for Multi-class Classification

Attack Class	ROC-AUC
FTP-Patator	1.0000
DDoS	0.9999
DoS Hulk	0.9999
DoS GoldenEye	0.9999
BENIGN	0.9999
PortScan	0.9999

TABLE VII: Detailed ROC-AUC Performance by Class

Fig. 5: Gini-based feature importance from Gradient Boosting (XGBoost) with MRMR feature selection (70% retention) on 60-10-30 split. Features are ranked by their mean decrease in impurity, with packet length statistics showing dominant predictive power.

Fig. 6: SHAP-based feature importance from Random Forest on 40-10-50 split. Bars represent mean absolute SHAP values (global impact), while colored dots show feature effects across individual classes. Flow rate metrics emerge as most influential, with notable class-specific variations.

Deployment Factor	Score	Rationale
Detection Accuracy	10/10	99.92% overall accuracy
False Positive Rate	9/10	0.08% misclassification rate
Computational Efficiency	9/10	324K predictions/second
Model Interpretability	10/10	Comprehensive SHAP analysis
Feature Optimization	10/10	30.6% reduction maintained performance
Generalization	9/10	Consistent cross-configuration performance

TABLE VIII: Deployment Readiness Assessment for CIC-IDS2017 Environment

Stratified Sampling

See all 10 papers

ExplainGuard: A Zero Trust Framework for Post-Hoc Explanation Integrity Guarantees in Blackbox XAI Models
Aug 22, 2026Maraz Mia, Shovan Roy, Mir Mehedi A. Pritom +1Black-Box Model Auditing Explainability Evaluation
Department of Computer Science Tennessee Tech University Cookeville, TN, USA
Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework
Jun 4, 2026B. M. Taslimul Haque, Md. Arifur Rahman, Md. Serajul Kabir Chowdhury Rubel +1Network Intrusion Detection Cybersecurity
Department of Business Information Systems, Central Michigan University, Mount Pleasant, Michigan, USA. · Department of Information Studies, Trine University, Angola, Indiana, USA. · Department of Computer Science, Maharishi International University, Fairfield, Iowa, USA,.
Stabilising Explainability Fragility in Cybersecurity AI: The Impact and Mitigation of Multicollinearity in Public Benchmark Datasets
May 21, 2026Ioannis J. Vourganas, Anna Lito MichalaSHAP Feature Attribution Explainability Evaluation
Netrity Ltd, Glasgow, UK · University of Glasgow, Glasgow, UK

Aug 22, 2026J/K move · Enter open · S save

ExplainGuard: A Zero Trust Framework for Post-Hoc Explanation Integrity Guarantees in Blackbox XAI Models

Maraz Mia, Shovan Roy, Mir Mehedi A. Pritom, Maanak Gupta

Department of Computer Science Tennessee Tech University Cookeville, TN, USA

Black-Box Model Auditing Explainability Evaluation Adversarial Attacks

Open paper AskPDF arXiv

As machine learning (ML) models are increasingly deployed in high-stakes environments, explainable AI (XAI) methods like SHAP and LIME have become essential for regulatory compliance and trust. However, the current auditing paradigm relies on an implicit "chain of trust" where third-party auditors are assumed to be trusted. Recent research demonstrates that this assumption is flawed and adversarial auditors can manipulate XAI explanations through manipulation attacks such as output shuffling or scaffolding out-of-distribution (OOD) to conceal model biases while maintaining high prediction accuracy aiming for fairwashed explanation. In this paper, we introduce a novel defense framework, ExplainGuard, that leverages a Zero-Trust architecture (ZTA) design to be incorporated within the XAI explanation supply chain and ensures the integrity of the generated explanation. This framework would help us to replace the ambiguous default assumption of "auditor is trustworthy," with a continuous "verify-then-trust" approach. Our design architecture establishes a Policy Decision Point (PDP) that enforces three distinct pillars of verification before any explanation is released to the user: (1) asset integrity via behavioral fingerprint to detect model substitution, (2) semantic validity using axiomatic consistency checks to reject mathematically impossible explanations, and (3) feature faithfulness verification utilizing a ranking stability approach with minimal computational overhead. Finally, we evaluate how ExplainGuard can effectively neutralize state- of-the-art explanation manipulation attacks while transforming the auditing process into a verifiable operation.

Abstract

Stratified Sampling

Explore similar work

ExplainGuard: A Zero Trust Framework for Post-Hoc Explanation Integrity Guarantees in Blackbox XAI Models

Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework

Stabilising Explainability Fragility in Cybersecurity AI: The Impact and Mitigation of Multicollinearity in Public Benchmark Datasets