A Calibrated and Explainable Bimodal Machine Learning Framework for Hybrid Intrusion Detection
2026-08-17 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors designed a machine learning system to better detect known and unknown cyberattacks in network data, especially when attack examples are rare. Their approach improves data quality, balances rare attack examples, and fine-tunes detection thresholds to catch uncommon threats without relying on very complex deep learning models. They also use a method called SHAP to explain why the system makes certain decisions, ensuring it focuses on meaningful security features. Tested on a popular dataset, their system accurately detects many known and unknown attacks, making it practical for real-world security use.
intrusion detection systemmachine learningclass imbalanceopen-set recognitioncalibrationexplainable AISHAPadaptive thresholdingfeature extractionCIC-IDS2017
Authors
Hafsa Aslam, Yue Li, Saba Aslam, Gracious Mwamughunda
Abstract
Modern communication systems face critical gaps in detecting unknown attacks and rare threat classes due to extreme data imbalance and black-box decision logic. We propose a bimodal framework of calibrated and explainable machine learning (ML) for network security, unifying known-class precision with open-set generalization without the complexity of deep learning. Our framework introduces security-oriented feature extraction to enhance signal-to-noise ratio, hybrid resampling (ADASYN + manual boosting) to reduce class imbalance, isotonic calibration and adaptive thresholding ($τ=0.30$ for XSS) to recover recall for rare attacks, and SHAP-based explainability to validate domain-aligned decision logic. Evaluated on the CIC-IDS2017 dataset and compared with prior ML models and studies, our framework achieves significant accuracy on known attacks (Macro F1 = 0.8626) and detects unknown classes at 1% FPR with TPR up to 90.17% (DoS slowloris), and 77.04% (Web-XSS). The SHAP analysis confirms decisions are driven by security-relevant features, not model artifacts. Our work bridges the gap between theoretical models and operational IDS by delivering calibrated, explainable, and open-set-capable attack detection and prevention in a single, reproducible framework. Keywords: intrusion detection, cybersecurity and privacy, explainable AI, machine learning