Search papers, labs, and topics across Lattice.
This paper introduces a bimodal machine learning framework designed for hybrid intrusion detection, addressing the challenges of data imbalance and opaque decision-making in modern communication systems. By integrating security-oriented feature extraction, hybrid resampling techniques, isotonic calibration, and SHAP-based explainability, the framework achieves a Macro F1 score of 0.8626 on known attacks while maintaining high true positive rates for rare threats with a low false positive rate. The results demonstrate that the framework not only enhances detection capabilities but also provides interpretable decision-making aligned with security-relevant features, bridging the gap between theoretical models and practical applications in intrusion detection systems.
Achieving a Macro F1 score of 0.8626 while detecting unknown attacks at a mere 1% false positive rate reveals a new standard for explainable and effective intrusion detection.
Modern communication systems face critical gaps in detecting unknown attacks and rare threat classes due to extreme data imbalance and black-box decision logic. We propose a bimodal framework of calibrated and explainable machine learning (ML) for network security, unifying known-class precision with open-set generalization without the complexity of deep learning. Our framework introduces security-oriented feature extraction to enhance signal-to-noise ratio, hybrid resampling (ADASYN + manual boosting) to reduce class imbalance, isotonic calibration and adaptive thresholding ($\tau=0.30$ for XSS) to recover recall for rare attacks, and SHAP-based explainability to validate domain-aligned decision logic. Evaluated on the CIC-IDS2017 dataset and compared with prior ML models and studies, our framework achieves significant accuracy on known attacks (Macro F1 = 0.8626) and detects unknown classes at 1% FPR with TPR up to 90.17% (DoS slowloris), and 77.04% (Web-XSS). The SHAP analysis confirms decisions are driven by security-relevant features, not model artifacts. Our work bridges the gap between theoretical models and operational IDS by delivering calibrated, explainable, and open-set-capable attack detection and prevention in a single, reproducible framework. Keywords: intrusion detection, cybersecurity and privacy, explainable AI, machine learning
