Attribution-Driven Explainable Intrusion Detection with Encoder-Based Large Language Models

Umesh Biswas; Shafqat Hasan; Syed Mohammed Farhan; Nisha Pillai; Charan Gudla

cs.CRApr 7, 2026

Attribution-Driven Explainable Intrusion Detection with Encoder-Based Large Language Models

Authors: Umesh Biswas, Shafqat Hasan, Syed Mohammed Farhan, Nisha Pillai, Charan Gudla

Organizations: Computer Science & Engineering, Mississippi State University

Abstract

Software-Defined Networking (SDN) improves network flexibility but also increases the need for reliable and interpretable intrusion detection. Large Language Models (LLMs) have recently been explored for cybersecurity tasks due to their strong representation learning capabilities; however, their lack of transparency limits their practical adoption in security-critical environments. Understanding how LLMs make decisions is therefore essential. This paper presents an attribution-driven analysis of encoder-based LLMs for network intrusion detection using flow-level traffic features. Attribution analysis demonstrates that model decisions are driven by meaningful traffic behavior patterns, improving transparency and trust in transformer-based SDN intrusion detection. These patterns align with established intrusion detection principles, indicating that LLMs learn attack behavior from traffic dynamics. This work demonstrates the value of attribution methods for validating and trusting LLM-based security analysis.

Figures & tables

Fig. 1: Overview of the proposed SDN intrusion detection framework, illustrating dataset preprocessing, textual encoding of flow features, COARSE label configuration, encoder-based LLM classification using RoBERTa and DeBERTa, and feature-aligned explainability via Integrated Gradients.

Class	Number of Samples
BENIGN	243,212
DDoS	121,606
Web Attack – Brute Force	1,408
Web Attack – XSS	624
Web Attack – SQL Injection	21

TABLE I: Dataset Class Distribution

Model	BENIGN			DDoS			Web Attack			F1 ${}_{\text{weighted}}$	F1 ${}_{\text{macro}}$
	P	R	F1	P	R	F1	P	R	F1
DeBERTa_Merged	0.9991	0.9998	0.9995	0.9999	0.9989	0.9994	0.9826	0.9611	0.9717	0.9993	0.9902
RoBERTa_Merged	0.9988	0.9991	0.9989	0.9998	0.9990	0.9994	0.9065	0.9197	0.9130	0.9986	0.9704

TABLE II: Per-class precision (P), recall (R), and F1-score for the merged Web Attack setting (COARSE 3-way).

Fig. 2: Integrated Gradients (IG) heatmap for the RoBERTa-based SDN intrusion detection model. Rows correspond to the COARSE intrusion classes (BENIGN, DDoS, Web Attack), and columns denote the top global SDN flow features ranked by mean absolute attribution.

Fig. 3: Integrated Gradients (IG) heatmap for the DeBERTa-based SDN intrusion detection model. Rows correspond to the COARSE intrusion classes (BENIGN, DDoS, Web Attack), and columns denote the top global SDN flow features ranked by mean absolute attribution.

Explainable Intrusion Detection

See all 14 papers

SDNGuardStack: An Explainable Ensemble Learning Framework for High-Accuracy Intrusion Detection in Software-Defined Networks
Apr 22, 2026Ashikuzzaman, Md. Saifuzzaman Abhi, Mahabubur Rahman +3Ensemble Learning Network Intrusion Detection
Dept. of CSE University of Barishal Barishal, Bangladesh · Dept. of CSE University of Scholars Dhaka, Bangladesh
Traffic-Aware Randomized Smoothing for LLM-Based Network Intrusion Detection
Jul 15, 2026Zhenpeng LiRandomized Smoothing Network Intrusion Detection
Jev-IDS: System One Models for Network Intrusion Detection
Oct 1, 2026Paulo Severo, Silvio E. Quincozes, Amanda DiasNetwork Intrusion Detection LLMs for Cybersecurity
Graduate Program in Software Engineering, Federal University of Pampa (UNIPAMPA), Alegrete, Rio Grande do Sul, Brazil

Apr 22, 2026J/K move · Enter open · S save

SDNGuardStack: An Explainable Ensemble Learning Framework for High-Accuracy Intrusion Detection in Software-Defined Networks

Ashikuzzaman, Md. Saifuzzaman Abhi, Mahabubur Rahman, Md. Manjur Ahmed+2

Dept. of CSE University of Barishal Barishal, Bangladesh · Dept. of CSE University of Scholars Dhaka, Bangladesh

Ensemble Learning Network Intrusion Detection Explainable Intrusion Detection

Open paper AskPDF arXiv

Software-Defined Networking (SDN) is another technology that has been developing in the last few years as a relevant technique to improve network programmability and administration. Nonetheless, its centralized design presents a major security issue, which requires effective intrusion detection systems. The SDN-specific machine learning-based intrusion detection system described in this paper is innovative because it is trained and tested on the InSDN dataset which models attack scenarios and realistic traffic patterns in SDN. Our approach incorporates a comprehensive preprocessing pipeline, feature selection via Mutual Information, and a novel ensemble learning model, SDNGuardStack, which combines multiple base learners to enhance detection accuracy and efficiency. In addition, we include explainable AI methods, including SHAP to add transparency to model predictions, which helps security analysts respond to incidents. The experiments prove that SDNGuard-Stack has an accuracy rate of 99.98% and a Cohen Kappa of 0.9998, surpassing other models, and at the same time being interpretable and practically executable. It is interesting to see such features like Flow ID, Bwd Header Len, and Src Port as the most important factors in the model predictions. The work is a step towards closing the gap between performance intrusion detection and realistic deployment in SDN, which will lead to the creation of secure and resilient network infrastructures.

Abstract

Explainable Intrusion Detection

Explore similar work

SDNGuardStack: An Explainable Ensemble Learning Framework for High-Accuracy Intrusion Detection in Software-Defined Networks

Traffic-Aware Randomized Smoothing for LLM-Based Network Intrusion Detection

Jev-IDS: System One Models for Network Intrusion Detection