Ensemble Deep Learning with Explainable AI for Intrusion Detection: A Comparative Study on the UNSW-NB15 Dataset
8th International Congress on Human-Computer Interaction, Optimization and Robotic Applications, ICHORA 2026, Ankara, Türkiye, 21 - 23 Mayıs 2026, (Tam Metin Bildiri)
- Yayın Türü: Bildiri / Tam Metin Bildiri
- Doi Numarası: 10.1109/ichora69329.2026.11537019
- Basıldığı Şehir: Ankara
- Basıldığı Ülke: Türkiye
- Anahtar Kelimeler: Deep Learning, Ensemble Learning, Explainable Artificial Intelligence, Intrusion Detection System, LIME, SHAP
- Ankara Üniversitesi Adresli: Evet
Özet
Network intrusion detection systems (NIDS) are critical for identifying malicious activities in modern network environments. Although deep learning models have demonstrated strong performance in this domain, their lack of interpretability remains a significant barrier to deployment in security-critical applications. In this paper, we propose and evaluate a comprehensive framework that combines multiple deep learning architectures, including the Convolutional Neural Network (CNN), Multilayer Perceptron (MLP), Artificial Neural Network (ANN), Simple Recurrent Neural Network (RNN) and three ensemble methods, namely Uniform Soft Voting, Weighted Soft Voting, and Stacking, in the UNSW-NB15 benchmark dataset for both binary (Normal vs. Attack) and multiclass (Normal and nine attack types) intrusion detection. To address the black-box nature of these models, we integrate LIME (Local Interpretable Modelagnostic Explanations) for local, instance-level interpretation and SHAP (SHapley Additive exPlanations) for global feature importance analysis, applied under both task formulations. In both binary and multiclass settings, the Stacking Ensemble achieves the best overall performance, followed closely by the ANN among individual models. The SHAP-based global analysis and LIMEbased local explanations provide complementary perspectives that enhance trust and transparency in deep learning-based intrusion detection.