Towards Interpretable Intrusion Detection: A Double-Layer GRU with Feature Fusion Explained by SHAP and LIME
DOI:
https://doi.org/10.52958/iftk.v21i3.12187Keywords:
Intrusion Detection System, Double Layer GRU, Feature Fusion, Explainable Artificial Intelligence (XAI), SHAP LIMEAbstract
Computer network security has become increasingly important with the growing complexity of cyberattacks. Deep learning-based Intrusion Detection Systems (IDS) represent a potential solution due to their capability to capture sequential patterns in network traffic. This study proposes a Double-Layer GRU-based IDS with Feature Fusion to enhance the representation of both numerical and categorical data in the NSL-KDD dataset. The training process employs systematic preprocessing techniques, including normalization and one-hot encoding. Experimental results demonstrate high accuracy and generalization with stable performance on both training and testing data, as well as competitive macro F1-scores for multi-class attack detection. Furthermore, interpretability aspects are explored through Explainable Artificial Intelligence (XAI) methods using SHAP and LIME. SHAP provides global insights into the contributions of important features, while LIME explains the influence of features at the local level for individual predictions. The integration of both methods not only enhances transparency and trust in the IDS but also offers deeper insights into dominant attributes in detecting attack patterns. Accordingly, this study contributes to the development of IDS that are accurate, interpretable, and applicable to modern network security.
References
V. Z. Mohale and I. C. Obagbuwa, “Evaluating machine learning-based intrusion detection systems with explainable AI: enhancing transparency and interpretability,” Front Comput Sci, vol. 7, May 2025, doi: 10.3389/fcomp.2025.1520741.
S. M. Kasongo, “A deep learning technique for intrusion detection system using a Recurrent Neural Networks based framework,” Comput Commun, vol. 199, pp. 113–125, Feb. 2023, doi: 10.1016/j.comcom.2022.12.010.
Y. Zeng, “CSAGC-IDS: A Dual-Module Deep Learning Network Intrusion Detection Model for Complex and Imbalanced Data,” arXiv preprint, May 2025, [Online]. Available: http://arxiv.org/abs/2505.14027
R. Younisse, A. Ahmad, and Q. Abu Al-Haija, “Explaining Intrusion Detection-Based Convolutional Neural Networks Using Shapley Additive Explanations (SHAP),” Big Data and Cognitive Computing, vol. 6, no. 4, p. 126, Oct. 2022, doi: 10.3390/bdcc6040126.
M. Al-Imran and S. H. Ripon, “Network Intrusion Detection: An Analytical Assessment Using Deep Learning and State-of-the-Art Machine Learning Models,” International Journal of Computational Intelligence Systems, vol. 14, no. 1, p. 200, Dec. 2021, doi: 10.1007/s44196-021-00047-4.
P. Hermosilla, S. Berríos, and H. Allende-Cid, “Explainable AI for Forensic Analysis: A Comparative Study of SHAP and LIME in Intrusion Detection Models,” Applied Sciences, vol. 15, no. 13, p. 7329, Jun. 2025, doi: 10.3390/app15137329.
O. Arreche, T. Guntur, and M. Abdallah, “XAI-IDS: Toward Proposing an Explainable Artificial Intelligence Framework for Enhancing Network Intrusion Detection Systems,” Applied Sciences, vol. 14, no. 10, p. 4170, May 2024, doi: 10.3390/app14104170.
M. Keshk, N. Koroniotis, N. Pham, N. Moustafa, B. Turnbull, and A. Y. Zomaya, “An explainable deep learning-enabled intrusion detection framework in IoT networks,” Inf Sci (N Y), vol. 639, p. 119000, Aug. 2023, doi: 10.1016/j.ins.2023.119000.
M. R. Wijaya, “Inovasi Model Intrusion Detection System (IDS) menggunakan Double Layer Gated Recurrent Unit (GRU) dengan Fitur Berbasis Fusion,” Jurnal Ilmiah Edutic : Pendidikan dan Informatika, vol. 12, no. 1, pp. 10–21, Feb. 2025, doi: 10.21107/edutic.v12i1.28822.
M. S. Al-kahtani, Z. Mehmood, T. Sadad, I. Zada, G. Ali, and M. ElAffendi, “Intrusion Detection in the Internet of Things Using Fusion of GRU-LSTM Deep Learning Model,” Intelligent Automation & Soft Computing, vol. 37, no. 2, pp. 2279–2290, 2023, doi: 10.32604/iasc.2023.037673.
C. E. Ben Ncir, M. A. Ben HajKacem, and M. Alattas, “Enhancing intrusion detection performance using explainable ensemble deep learning,” PeerJ Comput Sci, vol. 10, p. e2289, Sep. 2024, doi: 10.7717/peerj-cs.2289.
S. Neupane et al., “Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities,” IEEE Access, vol. 10, pp. 112392–112415, 2022, doi: 10.1109/ACCESS.2022.3216617.
S. Nazim, M. M. Alam, S. S. Rizvi, J. C. Mustapha, S. S. Hussain, and M. M. Suud, “Advancing malware imagery classification with explainable deep learning: A state-of-the-art approach using SHAP, LIME and Grad-CAM,” PLoS One, vol. 20, no. 5, p. e0318542, May 2025, doi: 10.1371/journal.pone.0318542.
U. Ahmed et al., “Hybrid bagging and boosting with SHAP based feature selection for enhanced predictive modeling in intrusion detection systems,” Sci Rep, vol. 14, no. 1, p. 30532, Dec. 2024, doi: 10.1038/s41598-024-81151-1.
M. Tawfik, “Optimized intrusion detection in IoT and fog computing using ensemble learning and advanced feature selection,” PLoS One, vol. 19, no. 8, p. e0304082, Aug. 2024, doi: 10.1371/journal.pone.0304082.
X. Larriva-Novo, C. Sánchez-Zas, V. A. Villagrá, A. Marín-Lopez, and J. Berrocal, “Leveraging Explainable Artificial Intelligence in Real-Time Cyberattack Identification: Intrusion Detection System Approach,” Applied Sciences, vol. 13, no. 15, p. 8587, Jul. 2023, doi: 10.3390/app13158587.
F. Hassan, J. Yu, Z. S. Syed, A. H. Magsi, and N. Ahmed, “Developing Transparent IDS for VANETs Using LIME and SHAP: An Empirical Study,” Computers, Materials & Continua, vol. 77, no. 3, pp. 3185–3208, 2023, doi: 10.32604/cmc.2023.044650.
T. B. Ogunseyi and G. Thiyagarajan, “An Explainable LSTM-Based Intrusion Detection System Optimized by Firefly Algorithm for IoT Networks,” Sensors, vol. 25, no. 7, p. 2288, Apr. 2025, doi: 10.3390/s25072288.
P. Hermosilla, S. Berríos, and H. Allende-Cid, “Explainable AI for Forensic Analysis: A Comparative Study of SHAP and LIME in Intrusion Detection Models,” Applied Sciences, vol. 15, no. 13, p. 7329, Jun. 2025, doi: 10.3390/app15137329.
H.-T. Pai, Y.-H. Kang, and W.-C. Chung, “An Interpretable Generalization Mechanism for Accurately Detecting Anomaly and Identifying Networking Intrusion Techniques,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 10302–10313, 2024, doi: 10.1109/TIFS.2024.3488967.
Downloads
Published
Issue
Section
License
Copyright (c) 2025 Mochamad Rozikul Wijaya, M. Hanafi
This work is licensed under a Creative Commons Attribution 4.0 International License.
KEBIJAKAN YANG DIAJUKAN UNTUK JURNAL YANG MENAWARKAN AKSES TERBUKA
Syarat yang harus dipenuhi oleh Penulis sebagai berikut:
- Penulis menyimpan hak cipta dan memberikan jurnal hak penerbitan pertama naskah secara simultan dengan lisensi di bawah Creative Commons Attribution License yang mengizinkan orang lain untuk berbagi pekerjaan dengan sebuah pernyataan kepenulisan pekerjaan dan penerbitan awal di jurnal ini.
- Penulis bisa memasukkan ke dalam penyusunan kontraktual tambahan terpisah untuk distribusi non ekslusif versi kaya terbitan jurnal (contoh: mempostingnya ke repositori institusional atau menerbitkannya dalam sebuah buku), dengan pengakuan penerbitan awalnya di jurnal ini.
- Penulis diizinkan dan didorong untuk mem-posting karya mereka online (contoh: di repositori institusional atau di website mereka) sebelum dan selama proses penyerahan, karena dapat mengarahkan ke pertukaran produktif, seperti halnya sitiran yang lebih awal dan lebih hebat dari karya yang diterbitkan. (Lihat Efek Akses Terbuka).
Download Template
