A Calibrated and Explainable Bimodal Machine Learning Framework for Hybrid Intrusion Detection

2026-08-17

AI Summary

This study addresses data imbalance, unknown attack identification, and decision opacity in network intrusion detection by proposing a calibrated, interpretable bimodal machine learning framework. Integrating security feature extraction, ADASYN hybrid resampling, and isotonic calibration with adaptive thresholding, the method enables open-set detection without deep learning while ensuring safety-aligned decision logic via SHAP analysis. This approach effectively balances known-class accuracy with generalization to unknown threats. Experimental results demonstrate a macro F1-score of 0.8626 and a 90.17% detection rate for unknown attacks at a 1% false positive rate. Furthermore, the derived decision logic aligns with cybersecurity domain knowledge, successfully reconciling model reliability with interpretability in complex intrusion detection scenarios.

Abstract

Modern communication systems face critical gaps in detecting unknown attacks and rare threat classes due to extreme data imbalance and black-box decision logic. We propose a bimodal framework of calibrated and explainable machine learning (ML) for network security, unifying known-class precision with open-set generalization without the complexity of deep learning. Our framework introduces security-oriented feature extraction to enhance signal-to-noise ratio, hybrid resampling (ADASYN + manual boosting) to reduce class imbalance, isotonic calibration and adaptive thresholding ($τ=0.30$ for XSS) to recover recall for rare attacks, and SHAP-based explainability to validate domain-aligned decision logic. Evaluated on the CIC-IDS2017 dataset and compared with prior ML models and studies, our framework achieves significant accuracy on known attacks (Macro F1 = 0.8626) and detects unknown classes at 1% FPR with TPR up to 90.17% (DoS slowloris), and 77.04% (Web-XSS). The SHAP analysis confirms decisions are driven by security-relevant features, not model artifacts. Our work bridges the gap between theoretical models and operational IDS by delivering calibrated, explainable, and open-set-capable attack detection and prevention in a single, reproducible framework. Keywords: intrusion detection, cybersecurity and privacy, explainable AI, machine learning

Problem

• Intrusion Detection
• Data Imbalance
• Unknown Attack Detection
• Explainable AI
• Black-box Decision Logic

Innovation

• Bimodal Framework
• Open-set Detection
• Isotonic Calibration
• SHAP Explainability
• Hybrid Resampling