Standardized Explainability Framework for Machine Learning-Based Network Intrusion Detection Systems

Abstract: Security analysts distrust machine learning intrusion detection outputs not because ML models are inaccurate, but because they provide no structured explanation of how a classification was reached—leaving analysts unable to validate, calibrate, or audit automated decisions. This paper proposes XAI-NIDS-Std, a Standardized Explainability Framework that addresses three persistent gaps: the absence of a unified explanation schema applicable across heterogeneous ML-IDS model classes, the lack of analyst-facing explanation quality metrics that measure decision support rather than model fidelity, and the failure of existing XAI-IDS implementations to satisfy GDPR Article 22 and the 2022 draft NIST AI RMF governance and transparency considerations at audit time. XAI-NIDS-Std defines a model- agnostic explanation contract—comprising SHAP global feature rankings, local counterfactual instances, and attention- derived evidence paths for transformer-class models—and integrates this contract into a unified analyst dashboard with decision audit logging. The framework is instantiated across four model classes (XGBoost, Random Forest, CNN-LSTM, and RoBERTa-IDS) on CICIDS-2017 and UNSW-NB15, producing explanation artifacts that achieve 93.2% analyst agreement rate—a 51 percentage point improvement over non-explained baselines—while reducing mean analyst decision time from 24.1 to 4.7 minutes. The framework maps its explanation artifacts to governance and transparency considerations in the 2022 draft NIST AI RMF and to GDPR Article 22(3) meaningful-information obligations.

Keywords: Analyst Trust, Counterfactual Explanation, Cybersecurity, Explainable AI, GDPR, Intrusion Detection, Machine Learning, NIST AI RMF, SHAP, Standardization, Transformer Networks, XAI