UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
arXiv:2605.22621v1 [cs.CR] 21 May 2026
Saif Alzubi · Frederic Stahl
Abstract The detection of previously unseen network attacks remains a major challenge for intrusion detection systems. Although supervised learning methods often perform well on known attack classes, they are limited when new attack types are not represented in the training data. Unsupervised methods are more suitable for detecting zero-day attacks, as they do not require labelled attack samples, but they often suffer from high false positive rates, which limits their real-world usefulness. This paper presents UNAD+, an enhanced framework for unknown network attack detection derived from the previously proposed Unknown Network Attack Detector (UNAD). UNAD+ combines a benign-only unsupervised ensemble with Weighted Majority Voting (WMV), a supervised refinement stage trained on pseudo-labelled detections, and a post hoc explainability layer that provides both local and global explanations. The framework was evaluated on the CICIDS2017 and NSL-KDD benchmark datasets. The results show that UNAD+ improves on the original UNAD framework, achieving F1-scores above 98% across the benchmark datasets while significantly reducing false positives and enhancing transparency and deployment suitability through integrated explainability. Keywords Network Intrusion Detection · Machine Learning · Explainable AI · Zero-Day Attack Detection
Saif Alzubi Department of Computer Science, University of Exeter, Exeter, UK E-mail: [email protected] Frederic Stahl German Research Center for Artificial Intelligence GmbH (DFKI), Marine Perception, Marie-Curie-Straße 1, 26129 Oldenburg, Germany E-mail: [email protected]
1 Introduction The increasing frequency and sophistication of networkbased attacks pose significant challenges to modern cybersecurity infrastructures. Intrusion Detection Systems (IDSs) continue to serve as a core defensive mechanism by monitoring and analysing network traffic to identify potentially malicious activity [1]. As network environments grow in size and complexity, it becomes increasingly difficult to distinguish malicious traffic from legitimate behaviour, especially when attacks are designed to resemble normal activity [2]. Despite substantial progress in machine learning-based IDS research, the reliable detection of unknown or previously unseen attacks remains a major challenge [3]. Many existing intelligent IDSs are based on supervised learning [4]. These approaches often achieve strong performance when the attack classes encountered during deployment are well represented in the labelled training data [5]. However, their effectiveness is limited to previously seen attack types, as they must be trained on labelled data that explicitly includes these attacks. In practice, newly emerging attacks, often referred to as zero-day attacks (i.e., attacks not previously seen by the system), may differ from the attack classes used during model training. As a result, supervised systems, although effective for known threats, often fail to generalise well to unfamiliar attack behaviours [6, 7]. In contrast, unsupervised learning methods attempt to detect anomalous activity without relying on labelled attack data [8], making them well-suited for identifying previously unknown or zero-day attacks. Instead of learning from known attack signatures, these methods learn the characteristics of benign or normal traffic and treat substantial deviations from this profile as suspicious. This makes them particularly useful in settings where labelled examples of new threats are not yet available.
2
However, unsupervised methods often suffer from high false positive rates (FPR) [9], which limits their practical applicability and can increase the burden on security analysts. Therefore, although unsupervised methods are important for zero-day detection, their outputs often require further refinement before they can be used reliably in real-world environments. These limitations motivate the development of hybrid IDS frameworks that combine the strengths of unsupervised and supervised learning. In such a design, an unsupervised stage can first identify suspicious traffic without requiring labelled attack data. In contrast, a supervised stage can learn from these detections and refine the final predictions. This reduces reliance on large volumes of labelled attack data while enabling the system to improve its detection capabilities after the initial discovery of a new threat. However, the design of such systems introduces further challenges, including how to combine the outputs of multiple anomaly detectors, how to reduce the effect of pseudo-labelling errors (i.e., errors arising when provisional benign or attack labels are assigned before the true class is confirmed), and how to make the final decisions understandable to human analysts. In addition to detection performance, transparency is also an important requirement in intelligent IDSs. Although hybrid machine learning systems can improve detection performance, their internal reasoning is often difficult to interpret at the system level [10]. Even when some individual classifiers are explainable, the interaction among multiple models can still result in black-box behaviour. This lack of transparency may reduce analyst trust and complicate root-cause analysis, incident triage, and compliance in regulated sectors such as healthcare and finance [11]. For this reason, explainable artificial intelligence (XAI) should be considered an integral part of deployable IDS design. By incorporating local and global explanation methods, the system can provide interpretable justifications for its decisions and support more transparent analysis [12]. To address these issues, this paper presents UNAD+, an enhanced framework for unknown network attack detection that extends the previously proposed Unknown Network Attack Detector (UNAD) [13]. The framework preserves the benign-only unsupervised detection capability of the original model and introduces three main extensions. First, a Weighted Majority Voting (WMV) mechanism replaces simple majority voting so that stronger base detectors have greater influence on the final ensemble decision. Second, a supervised refinement stage is introduced, in which pseudo-labelled benign and attack flows generated by the unsupervised ensemble are used to train a secondary classifier that improves
Saif Alzubi, Frederic Stahl
detection accuracy and reduces false positives. Third, a post hoc explainability layer is added, using local and global explanation methods to improve transparency and support analyst interpretation. In this way, UNAD+ combines unknown-attack detection, supervised refinement, and explainable decision support within a single modular framework for detecting zero-day or previously unseen attacks. The proposed framework is evaluated on two widely used intrusion detection benchmark datasets, CICIDS2017 [14] and NSL-KDD [15]. The empirical results show that UNAD+ significantly improves detection performance over the original UNAD baseline, while reducing false positives and enhancing transparency. Therefore, the contribution of this work is not limited to improving predictive performance; it also demonstrates how unsupervised detection, supervised refinement, and explainability can be integrated into a coherent IDS framework for more reliable zero-day attack detection. The paper is organised as follows: Section 2 reviews related work on ensemble-based intrusion detection, hybrid supervised-unsupervised approaches, and explainability techniques. Section 3 introduces the enhanced UNAD+ framework, detailing its weighted ensemble voting, supervised refinement using pseudo-labels, and post hoc explainability components. Section 4 presents the experimental evaluation. Section 5 outlines future work, followed by conclusions in Section 6. 2 Related Work Machine learning has become an important component of modern intrusion detection systems (IDSs), and many existing approaches are based on supervised models [16]. These methods often achieve strong classification performance when trained and tested on well-labelled datasets. However, their success depends heavily on the availability of labelled attack data [17], which is often incomplete and biased toward previously known threats. This limits their usefulness in detecting zero-day or previously unseen attacks. In contrast, unsupervised anomaly detection methods aim to identify deviations from normal behaviour without relying on labelled attack samples [18], making them more suitable for detecting unknown threats. Even so, their practical use remains challenging as they often produce high false positive rates [19], particularly in environments where benign traffic patterns are diverse or change over time [20]. Techniques such as clustering, autoencoders, and density-based methods, including Isolation Forest (iForest) [21] and Local Outlier Factor (LOF) [22], have been applied for this purpose, but their effectiveness varies across datasets and operational conditions.
UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
Ensemble-based intrusion detection has been studied to improve robustness and mitigate the limitations of individual anomaly detectors. The aggregation of multiple base learners often leads to more stable and accurate results than standalone models [23]. Several recent IDS studies aggregate ensemble outputs using majority voting [24,25,26]. For instance, this approach has been used to combine heterogeneous classifiers such as LSTM, KNN, and logistic regression [24], ensembles of tree-based models [25], and IoT-focused intrusion detection frameworks [26]. Although this approach is straightforward, it assumes that all base learners are equally reliable, an assumption that may not hold in practice. Some studies have explored weighting strategies based on model performance or confidence scores [27,28], showing that stronger classifiers can contribute more effectively to decisions in ambiguous cases. Nevertheless, weighted voting remains relatively underused in the IDS literature, particularly in systems specifically designed for unknown attack detection. Another line of research has focused on hybrid frameworks that combine unsupervised detection with supervised learning. The main motivation behind these systems is that an unsupervised stage can first detect suspicious or previously unknown traffic. In contrast, a supervised stage can then learn from those detections and improve the final classification results. Zoppi and Ceccarelli [29], for example, proposed a stacking-based framework in which anomaly outputs are refined by a supervised meta-classifier. Similarly, Kale et al. [30] combined clustering, semi-supervised learning, and supervised classification in a hybrid IDS setting. These studies demonstrate the value of combining different learning paradigms. However, many hybrid IDSs still provide limited detail on how pseudo-labels are managed, how error propagation is controlled, or how refinement is performed in a structured and repeatable way. As a result, although hybrid learning is promising, its integration into zero-day intrusion detection remains incomplete in many existing systems. Explainability has also become an important issue as IDS architectures grow more complex. Explainable artificial intelligence (XAI) techniques such as Local Interpretable Model-Agnostic Explanations (LIME) [31] and SHapley Additive exPlanations (SHAP) [32] have been used to provide local explanations for machine learning predictions. In cybersecurity, such methods are valuable as they help analysts understand why a flow has been classified as malicious and which features influenced that decision. However, much of the existing work on XAI in security primarily provides explanations after detection, rather than embedding them as an explicit architectural component of the IDS workflow [33,34].
3
Gaspar et al. [33] apply LIME and SHAP to explain the outputs of a black-box IDS model. In contrast, Arreche et al. [34] evaluate black-box XAI methods for network intrusion detection rather than incorporating explanation as an explicit component of the detection workflow, where it can support more transparent and actionable analysis. A further difficulty in evaluating IDS frameworks lies in the datasets used for benchmarking. CICIDS2017 [14] and NSL-KDD [15] are among the most widely used datasets in intrusion detection research, but they differ considerably in their traffic composition, attack diversity, and complexity. As a result, strong performance on one dataset does not necessarily indicate equivalent robustness on another. Although many studies report encouraging results on these benchmarks [35, 9], fewer provide a combined solution that addresses the following three issues: detecting unknown attacks, refining detections through supervised learning, and providing transparent explanations of system decisions. However, limited attention has been given to systems that combine benign-only unsupervised detection, structured supervised refinement, and integrated explanation within a single framework. This gap motivates the UNAD+ framework proposed in this paper.
3 UNAD+: Framework Design and Components Building on the original UNAD framework, UNAD+ introduces three main extensions: weighted voting for improved ensemble decision-making, supervised refinement for more accurate and robust detection, and explainability for greater transparency and analyst support.
3.1
The Original UNAD Framework
The original UNAD [13] is an unsupervised, ensemblebased intrusion detection framework designed to identify previously unseen attacks. In contrast to signature-based and supervised IDSs, UNAD is trained only on benign traffic. This enables the system to detect anomalous behaviour without requiring prior knowledge of attack signatures or labelled malicious instances. UNAD uses a heterogeneous ensemble of 100 base learners, consisting of 50 Local Outlier Factor (LOF) models [22] and 50 Isolation Forest (iForest) models [21]. Each learner is trained on a bootstrapped subset of benign data using bagging in order to promote diversity among the base detectors and reduce overfitting. The predictions produced by the ensemble are then combined using simple majority voting, where each model contributes one vote for either the benign or attack
4
Saif Alzubi, Frederic Stahl
class, and the majority of votes determines the final prediction. Although the original UNAD demonstrated that benign-only anomaly detection can identify unknown attacks, it also exhibited several limitations. First, the voting process assigned equal importance to all base learners, even though their performance could vary. Second, tying cases at the individual-prediction level required human intervention, reducing the level of automation in the detection process. Third, the framework lacked a mechanism to explain its decisions, limiting its suitability for practical deployment in settings where transparency and analyst trust are important.
3.2
Overview of UNAD+
To address the limitations of the original UNAD, this paper proposes UNAD+, which preserves the benign-only unsupervised detection capability of the original framework while introducing three main enhancements: (1) Weighted Majority Voting, (2) a supervised refinement stage, and (3) a post hoc explainability layer. Figure 1 shows the overall architecture of UNAD+, including the unsupervised ensemble (C1), the supervised refinement stage (C2), the human-in-the-loop checkpoint, and the explainability component (C3). In this architecture, the first component detects suspicious or previously unseen traffic using a benign-only unsupervised ensemble. The second component refines these preliminary detections through supervised learning on pseudo-labelled outputs from the first stage, thereby improving classification quality and reducing false positives. The third component provides local and global explanations for the final decisions, improving transparency and helping analysts understand why a flow was classified as benign or malicious. To further improve robustness, a human-in-the-loop checkpoint is placed between the unsupervised ensemble and the supervised refinement stage [36]. This step allows a domain expert to review and validate a subset of pseudo-labelled detections before they are used for supervised learning. In this way, the framework reduces the risk of passing incorrect or unreliable labels from the unsupervised ensemble into the refinement component.
3.3
Ensemble Design and Bagging Strategy
The first stage of UNAD+ consists of data preprocessing followed by unsupervised ensemble construction. Figure 2 illustrates the structure of the unsupervised ensemble used in UNAD+. Before training, Principal Component Analysis (PCA) is applied to reduce dimensionality [37].
For each dataset and detector, the number of retained principal components is determined through experimental tuning and selected based on the highest F1-score achieved [36]. The resulting reduced representations are then used as input to the unsupervised ensemble. As in the original UNAD, the unsupervised ensemble combines 50 LOF learners and 50 iForest learners. This configuration was retained because an ensemble of 100 base learners produced the strongest overall performance, while the equal split between LOF and iForest avoided bias towards one learner type [13]. Among the anomaly detection methods initially considered, including Local Outlier Factor (LOF), Isolation Forest (iForest), Elliptic Envelope (EE), and One-Class Support Vector Machine (OCSVM), LOF and iForest achieved the strongest overall F1-scores and were therefore selected. Bagging is used to introduce variation across the ensemble by training each base learner on a different bootstrapped sample of the benign training data [38]. This improves generalisability and reduces the effect of instability in individual learners. In addition to sample-level variation, further heterogeneity is introduced through the use of different high-performing hyperparameter combinations for each learner type. As a result, the ensemble benefits from both algorithmic heterogeneity, through the combined use of LOF and iForest, and internal variation, through multiple parameter settings and bootstrapped training subsets. Such a structure enables the system to better capture different forms of anomalous behaviour in network traffic.
3.4
Voting Strategy: Weighted Majority Voting (WMV)
A key limitation of the original UNAD was its reliance on simple majority voting, which treats all base learners equally. In practice, however, not all base learners contribute equally to the final decision. Giving equal influence to weaker and stronger learners may reduce the effectiveness of the final decision and, in the case of an even number of learners, may also lead to tied votes that require tie-breaking. To address this, UNAD+ replaces simple majority voting with Weighted Majority Voting (WMV). During validation, each base learner receives a weight proportional to its F1-score. At inference, predictions (0 for benign, 1 for attack) mask their weights. Scores for each class are summed, and the highest score is used as the ensemble output. This strategy gives stronger detectors greater influence on the final decision than weaker ones. As a
UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
5
Fig. 1: Architecture of UNAD+: (1) unsupervised ensemble trained on benign data; (2) supervised refinement using pseudo-labels; (3) post hoc explainability for local and global interpretation. result, the effect of unreliable models is reduced, and the ensemble is expected to yield more decisive predictions. Another practical advantage of WMV is that it removes the tie-related ambiguity observed in the original majority-voting version of UNAD, where tied votes were resolved in favour of the benign class, thereby introducing a bias towards benign predictions. Because the decision is based on continuous weighted scores rather than equal vote counts, exact ties become highly unlikely. WMV is therefore expected to improve the operational reliability of the framework while preserving the benefits of ensemble-based anomaly detection. The implementation of WMV in UNAD+ is shown in Algorithm 1.
Algorithm 1 Weighted Majority Voting in UNAD+
Fig. 2: Workflow of the unsupervised ensemble stage in UNAD+.
1: Input: Predictions P = [p1 , p2 , . . . , pn ], where pi ∈ {benign, attack} F1-scores F = [f1 , f2 , . . . , fn ] for each base learner 2: Output: Final class label for the instance 3: 4: Initialize: Scorebenign ← 0, Scoreattack ← 0 5: for i = 1 to n do 6: if pi = benign then 7: Scorebenign ← Scorebenign + fi 8: else 9: Scoreattack ← Scoreattack + fi 10: end if 11: end for 12: if Scoreattack > Scorebenign then 13: return attack 14: else 15: return benign 16: end if
6
3.5
Saif Alzubi, Frederic Stahl
Supervised Refinement
Although the weighted unsupervised ensemble provides the first stage of unknown attack detection, false positives and false negatives still occur. To improve the quality of these initial detections, UNAD+ introduces a supervised refinement stage after the WMV ensemble. In this stage, the correctly detected benign and attack instances produced by the unsupervised ensemble are used as pseudo-labels. These pseudo-labelled instances are combined with the original benign training data to create an expanded training set for supervised learning. This allows the second-stage classifier to learn more precise decision boundaries using traffic patterns that are closer to the operational detection setting than the original benign-only data alone. Several supervised classifiers were evaluated for this role, including AdaBoost, Naive Bayes, K-Nearest Neighbours, and Random Forest. Before training, feature selection was applied using Information Gain (IG), and candidate feature subsets were assessed incrementally. Starting from the top five IG-ranked features, one additional feature was added at each iteration until the best 30 features had been evaluated. For each candidate subset, 10-fold cross-validation was used with a grid search to optimise model hyperparameters, and the final supervised classifier was selected based on the highest F1-score. To address class imbalance in the combined dataset, the Synthetic Minority Oversampling Technique (SMOTE) [39] was applied after feature selection to balance the attack and benign classes to a 1:1 ratio. Among the evaluated classifiers, Random Forest consistently achieved the strongest results and was therefore selected as the refinement classifier. In addition to its strong empirical performance, Random Forest is robust to overfitting and is also suitable for post hoc interpretability through feature importance analysis and surrogate modelling [40,41]. In this way, the second stage of UNAD+ serves as a refinement component that improves the quality of the initial anomaly detections and substantially reduces false positives.
For local explainability, Local Interpretable ModelAgnostic Explanations (LIME) [31] is applied to the Random Forest refinement classifier. LIME explains an individual prediction by perturbing the input instance, observing how the classifier’s output changes, and identifying the features that contribute most strongly to the final decision. LIME was selected for its model-agnostic nature, ease of application, and suitability for tabular network traffic data [31]. It also requires limited reconfiguration when the underlying model is updated. Compared with alternatives such as SHAP, which provides theoretically grounded Shapley-value explanations, [42] LIME offers a more computationally efficient way to generate local explanations in this application setting [31]. For global explainability, a Decision Tree surrogate model is trained to approximate the behaviour of the Random Forest. The surrogate is fitted using the input samples and the predictions generated by the Random Forest, and its fidelity is then evaluated to determine how well it reproduces the original model’s behaviour. Although the surrogate is simpler than the original classifier, it provides a more interpretable view of the overall decision logic, including dominant rules, feature interactions, and broad decision boundaries [43]. This global explanation helps analysts inspect the system’s behaviour as a whole and supports auditing, validation, and model debugging. Local and global explanations, therefore, serve complementary roles in UNAD+. Local explanations support the analysis of individual flows, while the surrogate model provides a broader understanding of how the refinement classifier behaves across the dataset.
4 Experimental Evaluation and Analysis The experimental evaluation assesses the detection performance, robustness, and explainability of UNAD+, with particular attention to the effects of weighted voting and supervised refinement compared with the original UNAD and baseline models.
4.1 3.6
Datasets
Explainability Layer
A further limitation of the original UNAD framework was the absence of interpretability. In practice, this limits the system’s usefulness in environments where human analysts must inspect, validate, and trust model decisions. To address this issue, UNAD+ incorporates a post hoc explainability layer that supports both local and global interpretations.
Two publicly available benchmark datasets were used to evaluate the proposed framework: CICIDS2017 [14] and NSL-KDD [15]. CICIDS2017 was selected as it provides more recent and diverse attack scenarios in a realistic network setting, whereas NSL-KDD was included as a widely used benchmark with a different traffic structure and attack composition. Evaluating UNAD+ on both datasets therefore, supports a broader assessment of
UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
robustness and generalisability across different feature spaces, class distributions, and attack categories. Table 1 summarises the main characteristics of the two datasets used in the evaluation. CICIDS2017 is a publicly available benchmark dataset generated by the Canadian Institute for Cybersecurity over five days and consists of about 3 million data instances [14]. Developed in a realistic network environment, it includes multiple operating systems and commonly used protocols such as HTTP, HTTPS, FTP, SSH, and email protocols. Compared with legacy IDS benchmarks, CICIDS2017 provides a more recent and more representative view of modern network traffic. The dataset covers 14 attacks grouped into seven categories: Brute Force, Heartbleed, Botnet, DoS, DDoS, Web Attacks, and Infiltration. The attack types considered in this study were DoS Hulk, Port Scan, DDoS, DoS GoldenEye, FTP-Patator, SSH-Patator, DoS Slowloris, DoS Slowhttptest, Botnet, Web Attack-Brute Force, Web Attack-XSS, Infiltration, Web Attack-SQL Injection, and Heartbleed. Traffic features were extracted from PCAP files using CICFlowMeter, which generates 84 network traffic features together with the class label. NSL-KDD is an updated version of the KDD99 dataset, which was originally derived from the DARPA98 dataset. The benchmark was introduced to address known limitations of KDD99, particularly the large number of duplicate records that can bias model evaluation [15]. NSL-KDD consists of two files: KDDTrain+, containing 125,973 records, and KDDTest+, containing 22,544 records. Four main attack categories are represented in addition to normal traffic: Denial of Service (DoS), User to Root (U2R), Remote to Local (R2L), and Probe. Its 43 features are grouped into three types: basic features derived from TCP/IP connections, traffic features computed over time windows, and content features designed to capture suspicious behaviour relevant to classes such as R2L and U2R. Given its different structure and attack composition, NSL-KDD provides a useful complement to CICIDS2017 in evaluating the proposed framework across heterogeneous benchmark settings. 4.2
Preprocessing and Hyperparameter Tuning
For CICIDS2017, preprocessing began with the removal of duplicate, missing, and invalid records. Features representing IDs, IP addresses, and ports were then discarded, as they do not provide stable discriminatory value for intrusion detection and may bias the model towards dataset-specific characteristics. The label field was converted to binary, with benign flows assigned 0 and all attack types assigned 1. The data were subsequently
7
normalised using Min-Max scaling. After preprocessing, the dataset retained 76 final features and contained 2,827,672 flows, of which 2,271,117 were benign, and 556,555 were attacks. To reflect the zero-day detection setting, benign Monday traffic, comprising 529,445 flows, was used as the training set for the unsupervised ensemble. PCA was then applied for dimensionality reduction, with 7 principal components used for LOF and 11 for iForest.
For NSL-KDD, preprocessing followed a similar procedure, including the removal of missing and duplicate records, binary label encoding, and Min-Max scaling. In addition, the categorical features protocol type, service, and flag were converted to numeric form using one-hot encoding, resulting in 122 final features. The KDDTrain+ file was first split into 60% training and 40% hold-out data. Since the unsupervised ensemble was trained only on benign traffic, all attack instances were removed from the training portion, leaving 40,405 normal records. The remaining 40% of KDDTrain+ was then combined with KDDTest+ and re-split into a validation set of 37,791 instances and a test set of 35,140 instances using stratified random sampling so that both sets contained representative attack classes. PCA was again applied, with 7 principal components used for LOF and 16 for iForest.
Hyperparameters for both the unsupervised models and the supervised refinement classifier were optimised using grid search, with F1-score used as the primary selection criterion. For LOF, the contamination parameter was explored from 0.01 to 0.50 in steps of 0.01, and the number of neighbours from 5 to 50 in steps of 5. For iForest, contamination was explored over the same range. At the same time, the number of estimators was varied from 50 to 600 in steps of 50, and the maximum number of samples was assessed using the auto setting together with 25%, 50%, 75%, and 100% of the training data. For the supervised refinement stage, Random Forest was selected as the final classifier after tuning the candidate models described in Section 3.5. The explored hyperparameter ranges for Random Forest included the number of estimators from 100 to 500 in steps of 50, the maximum depth over the default setting, together with values from 5 to 15 in steps of 5, the minimum samples split from 2 to 8 in steps of 2, and the minimum samples leaf over the default setting together with values from 2 to 6 in steps of 2. Table 2 summarises the hyperparameter ranges explored and the final values selected for the models used in the experiments.
8
Saif Alzubi, Frederic Stahl
Table 1: Summary of the datasets used in the evaluation. Dataset
Features
Total records
Attack categories
CICIDS2017
84
2,829,463
Brute Force, Heartbleed, Botnet, DoS, DDoS, Web Attacks, Infiltration
NSL-KDD
43
125,973 (KDDTrain+) + 22,544 (KDDTest+)
DoS, U2R, R2L, Probe
Table 2: Hyperparameter tuning ranges and selected values for LOF, iForest, and Random Forest.
4.3
Model
Parameter
Range explored
Final value (CICIDS2017)
Final value (NSL-KDD)
LOF
PCA components contamination n neighbors
2–15 (CICIDS2017), 2–17 (NSL-KDD) 0.01–0.50 5–50
7 0.07 30
7 0.14 5
iForest
PCA components contamination n estimators max samples
2–15 (CICIDS2017), 2–17 (NSL-KDD) 0.01–0.50 50–600 auto, 25%, 50%, 75%, 100%
11 0.24 400 25%
16 0.10 100 100%
Random Forest
n estimators max depth min samples split min samples leaf
100–500 Default, 5, 10, 15 2–8 Default, 2–6
100 10 8 2
300 15 4 Default
Evaluation Metrics
The evaluation uses standard binary classification measures, namely Precision, Recall, F1-score, ROC-AUC, and False Positive Rate (FPR). In all experiments, attack instances were treated as anomalous and benign or normal instances as non-anomalous. These measures were selected to assess detection quality and operational reliability jointly. In intrusion detection, it is important not only to detect malicious traffic, but also to limit the number of benign flows incorrectly classified as attacks. Precision measures the proportion of detected attacks that are truly malicious, while Recall measures the proportion of actual attacks that are successfully detected. F1-score combines these two measures and was therefore used as the main performance indicator throughout the model-selection process. ROC-AUC was used to assess class separation across thresholds, while FPR quantified the extent to which benign traffic was incorrectly flagged as malicious.
4.4
Overall Performance on CICIDS2017 and NSL-KDD
Detection performance was evaluated for four settings: the original UNAD using simple majority voting, the weighted ensemble version (UNAD+ WMV Ensemble), the standalone supervised refinement classifier, and the full combined UNAD+ framework. The standalone supervised refinement classifier was evaluated separately on ensemble error cases, namely false positives and false
negatives, and is included here as a diagnostic comparison. Tables 3 and 4 report the results obtained on CICIDS2017 and NSL-KDD, respectively, across the standard evaluation metrics. On CICIDS2017, the original UNAD achieved an F1-score of 75.19%, while the UNAD+ WMV Ensemble achieved 74.91%. The supervised refinement classifier achieved an F1-score of 90.59%, and the final combined UNAD+ framework reached an F1-score of 98.31%, along with 99.44% precision, 99.21% recall, and 98.52% ROC-AUC. On NSL-KDD, the original UNAD achieved an F1-score of 93.38%, while UNAD+ WMV Ensemble achieved 93.16%. The supervised refinement classifier achieved an F1-score of 78.47%, and the full UNAD+ framework reached 98.25%, with 97.26% precision, 99.26% recall, and 98.24% ROC-AUC. These results show that the weighted voting stage alone did not improve the F1-score relative to the original UNAD. However, the higher F1-scores obtained by the original UNAD should not be interpreted as evidence of superior first-stage performance, since under simple majority voting, tied votes were resolved in favour of the benign class, thereby introducing a systematic bias towards benign predictions. Overall, the strongest performance was achieved by the full UNAD+ framework after combining weighted ensemble detection with supervised refinement. On CICIDS2017, the F1-score increased from 75.19% in the original UNAD to 98.31% in the final combined framework, while on NSL-KDD, the F1-score increased from 93.38% to 98.25%. These results confirm that the main contribution of UNAD+ lies not in the weighted voting
UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
9
Table 3: CICIDS2017 Results (in %). Model Original UNAD UNAD+ WMV Ensemble Standalone Supervised Refinement Classifier Final Combined Framework
Accuracy
Precision
Recall
F1-score
ROC-AUC
87.23 86.84 93.86 99.19
70.99 69.57 96.69 99.44
79.92 81.14 85.22 99.21
75.19 74.91 90.59 98.31
84.74 84.90 91.83 98.52
Table 4: NSL-KDD Results (in %). Model Original UNAD UNAD+ WMV Ensemble Standalone Supervised Refinement Classifier Final Combined Framework
Accuracy
Precision
Recall
F1-score
ROC-AUC
93.45 93.22 74.02 98.24
93.90 93.52 69.76 97.26
92.86 92.80 89.67 99.26
93.38 93.16 78.47 98.25
93.44 93.22 73.10 98.24
stage in isolation, but in the combination of weighted ensemble detection and supervised refinement using pseudo-labelled data.
4.5
Impact of Supervised Refinement
To assess the contribution of the second stage of the framework, an ablation analysis was conducted by comparing the weighted ensemble alone with the framework after supervised refinement. The main objective of this analysis was to examine the effect of the refinement stage on false-positive reduction, since high false-positive rates remain a major limitation of anomaly-based intrusion detection systems. Figure 3 presents the false positive rate (FPR) before and after applying the supervised refinement stage on CICIDS2017 and NSL-KDD.
FPR decreased from 11.34% in the weighted ensemble to 0.18% after refinement, representing a reduction of more than 98%. On NSL-KDD, the FPR decreased from 6.37% to 2.77%, corresponding to a reduction of more than half. These results show that the refinement stage effectively suppressed a large proportion of the spurious alerts produced by the unsupervised ensemble. This improvement reflects the role of the secondstage classifier. After the weighted ensemble identifies suspicious traffic, its correctly detected benign and attack instances are used as pseudo-labelled data for supervised learning. This enables the refinement classifier to learn more precise decision boundaries from samples that are closer to the operational detection setting than the original benign-only training data. As a result, the second stage can correct a large proportion of the residual errors produced by the first stage, particularly when benign and malicious behaviours overlap. The supervised refinement classifier was evaluated on dedicated test sets consisting of instances previously misclassified by the ensemble, namely false positives and false negatives. This corresponded to 151,245 instances for CICIDS2017 and 2,383 instances for NSL-KDD. The strong reduction in FPR therefore indicates that the second stage does not merely repeat the decisions of the ensemble, but instead provides a meaningful correction mechanism that improves the reliability of the framework.
Fig. 3: Impact of supervised refinement on false positive rate (FPR) for CICIDS2017 and NSL-KDD.
The supervised refinement stage significantly reduced the FPR on both datasets. On CICIDS2017, the
The results confirm that the supervised refinement stage plays an important role in improving the realworld usefulness of UNAD+. It addresses one of the main weaknesses of unsupervised anomaly detection by significantly reducing false positives while preserving strong detection performance, thereby directly contributing to the improvement achieved by the final combined framework.
10
Saif Alzubi, Frederic Stahl
4.7
Fig. 4: Comparison of tie-case proportions under majority voting and weighted majority voting on CICIDS2017 and NSL-KDD.
4.6
Effect of Ensemble Voting Strategy
To evaluate the effect of the ensemble voting strategy, Weighted Majority Voting (WMV) was compared with the original simple majority voting approach on both the CICIDS2017 and NSL-KDD datasets. Figure 4 presents the proportion of tie cases produced by the two voting strategies on the two datasets. Under simple majority voting, equal numbers of benign and attack votes resulted in tied cases, which were resolved in favour of the benign class label. This introduced ambiguity into the first stage of detection and reduced the operational reliability of the original UNAD framework. Simple majority voting resulted in ties in 15.1% of predictions on CICIDS2017 and 2.5% on NSL-KDD. In contrast, WMV reduced ties to 0% across both datasets by assigning each base learner a weight according to its F1-score, thereby giving greater influence to stronger detectors. This made the first-stage ensemble more decisive by eliminating tied votes, which under simple majority voting were resolved in favour of the benign class. The effect was more pronounced on CICIDS2017, where the diversity of traffic types appears to have led to greater variation in the predictions of the base learners. Although the overall metric differences between majority voting and WMV were relatively small, WMV offered a significant practical advantage. By eliminating tie cases, it removed one of the main limitations of the original UNAD and improved the consistency and operational suitability of the ensemble, since the firststage detector no longer depended on benign-default resolution when equal votes occurred.
Class-Level Detection Analysis
To assess the behaviour of the framework beyond aggregate metrics, class-level detection rates were analysed for both datasets. Figures 5 and 6 compare three stages of the proposed system: the weighted unsupervised ensemble, the supervised refinement classifier evaluated separately, and the final combined framework, in which the weighted ensemble is followed by the supervised refinement stage, on CICIDS2017 and NSL-KDD, respectively. This analysis highlights which traffic classes benefited most from the second stage and which remained difficult to detect. On CICIDS2017, the supervised refinement stage contributed significantly to improving the detection of several attack types. As shown in Figure 5, the final combined framework improved the detection rates for benign traffic and most attack classes compared with the weighted ensemble alone. The benign detection rate increased by just over 11%, from 88.66% to 99.82%. Among the attack classes, the largest improvements were observed for SSH-Patator, which increased from 43.42% to 98.03%, and DoS Slowhttptest, which improved to 97.71%. Strong gains were also observed for DoS Slowloris, DDoS, and DoS Hulk, while FTP-Patator and DoS GoldenEye also improved after the second-stage refinement. In contrast, port scans and Bot attacks improved only marginally. These results indicate that the second stage was particularly effective for attack categories that were initially detected with moderate performance by the ensemble, but for which sufficient pseudo-labelled training instances were available. In contrast, the classes that did not improve were those for which only very small numbers of pseudo-labelled examples reached the supervised stage. As a result, the refinement classifier was unable to improve detection for web attacks and infiltration. The weak performance on these rare CICIDS2017 classes is attributable to the very small number of pseudo-labelled instances that reached the supervised refinement stage. For example, the supervised model was trained on only 59 brute force, 13 XSS, 8 infiltration, and 1 SQL injection instances. In addition, dimensionality reduction through PCA may also have reduced information useful for distinguishing these rare attack types. NSL-KDD showed a similar pattern, but with a more consistent improvement across classes. As shown in Figure 6, the final combined framework improved the detection rate for normal traffic and all attack categories after adding the supervised refinement classifier. The largest gain was observed for R2L attacks, where the detection rate increased from 51.55% to 92.33%. U2R
UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
11
Fig. 5: Comparison of class-level detection rates on CICIDS2017 for the weighted ensemble (UNAD+ WMV), the supervised refinement classifier, and the final combined framework (in %).
Fig. 6: Comparison of class-level detection rates on NSL-KDD for the weighted ensemble (UNAD+ WMV), the supervised refinement classifier, and the final combined framework (in %). attacks also improved substantially, from 77.72% to 94.06%. In addition, normal and DoS traffic improved by more than 3%, while Probe attacks improved by about 1%. These results suggest that the refinement stage was especially useful for rare and difficult attack classes in NSL-KDD, while also preserving the already
strong performance of the weighted ensemble on the easier categories. The class-level analysis shows that the main benefit of the hybrid framework lies in its ability to improve classes that are either highly variable or initially difficult for the unsupervised ensemble alone. At the same time, it shows that the success of the refinement stage
12
Saif Alzubi, Frederic Stahl
depends on the availability of sufficiently informative pseudo-labelled examples. Therefore, while UNAD+ improves detection across most major traffic classes and significantly strengthens several difficult categories, its performance remains limited for very rare classes that are weakly represented in the first-stage detections. 4.8
Evaluation of the Explainability Component
The explainability component was examined in terms of plausibility, qualitative stability, and fidelity. Plausibility refers to whether the explanations highlight traffic features that are meaningful for the predicted class. Stability refers here to whether local explanations remain broadly consistent across repeated inspection and small input changes. Fidelity refers to how accurately a simpler surrogate model can reproduce the behaviour of the Random Forest refinement classifier. Figure 7 presents representative local explanations generated by LIME for CICIDS2017, Figure 8 presents the corresponding local explanations for NSL-KDD, and Figure 9 shows the Decision Tree surrogate models used for global interpretation. In terms of plausibility, the local explanations indicated that the refinement classifier relied on coherent and interpretable traffic characteristics. On CICIDS2017, LIME repeatedly highlighted features such as Init Win Bytes Backwards, Subflow Bwd Packets, Fwd Packet Length Max, and Packet Length Variance for correctly classified attack instances, including SSH-Patator and DoS Slowhttptest. As shown in Figure 7(a), these features appear consistently across representative attack cases rather than as isolated patterns. This supports the interpretation that the classifier’s local reasoning aligns with meaningful indicators of abnormal flow behaviour rather than spurious correlations. A similar pattern was observed on NSL-KDD. For representative DoS and R2L instances, the most influential LIME features included dst bytes, flag, and service. These are interpretable network-level attributes, and their repeated appearance in the local explanations suggests that the refinement classifier is using features that are relevant to suspicious traffic behaviour. As illustrated in Figure 8(a), the usefulness of the local explanation layer lies not only in producing explanations, but also in grounding those explanations in features that an analyst can interpret and assess. With respect to stability, the local explanations appeared broadly consistent across repeated inspection of representative cases and were not highly sensitive to small input changes. This is relevant because an explanation method has limited practical value if minor changes
in the input produce substantially different explanations. In the present case, the observed consistency suggests that LIME is suitable as an analyst-facing explanation tool within the framework. The local explanation layer was also informative in analysing classifier errors. As shown in Figures 7(b) and 8(b), incorrectly classified attack instances on both datasets still yielded interpretable feature-level explanations, making it possible to identify which features pushed the prediction towards the wrong class. This is analytically important, as it shows that the explanation layer remains informative even when the classifier fails. In such cases, the issue is not the absence of interpretable structure, but rather that the balance of influential features favours the incorrect class. This makes the explanations useful for debugging and for identifying systematic weaknesses in the refinement classifier. Regarding fidelity, the global explainability layer was evaluated by training a Decision Tree surrogate model to approximate the predictions of the Random Forest refinement classifier. Fidelity was measured using accuracy against the Random Forest outputs, and the resulting score exceeded 99% on both datasets. As shown in Figure 9, the surrogate models capture the dominant decision rules and feature splits of the refinement classifier while remaining substantially easier to inspect than the original model. This indicates that the broader behaviour of the second-stage classifier can be approximated in an interpretable form while preserving its main decision rules, feature splits, and overall classification logic. The global explainability layer was further supported by a rule-extraction component derived from the surrogate Decision Tree. This complements the surrogate models shown in Figure 9 by providing a more structured view of the classifier’s broader decision logic, including the dominant feature thresholds and decision paths associated with attack and benign predictions. In this way, the global explanation layer supports auditing, validation, and the identification of possible operational blind spots, for example, cases where the classifier relies too heavily on a small number of features or fails to distinguish rare attack patterns effectively. Overall, the explainability evaluation suggests that the post hoc explanation layer improves the interpretability of the framework. The local explanations support plausibility by highlighting meaningful traffic features and showing broad consistency across representative analyses, while the global surrogate maintains high fidelity to the refinement classifier. This combination improves transparency in ways that support analyst trust, auditing, debugging, and security review.
UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
(a) LIME explanation for a correctly classified attack instance.
13
(b) LIME explanation for an incorrectly classified attack instance.
Fig. 7: Local LIME explanations for attack instances on CICIDS2017.
(a) LIME explanation for a correctly classified attack instance.
(b) LIME explanation for an incorrectly classified attack instance.
Fig. 8: Local LIME explanations for attack instances on NSL-KDD. 5 Future Work
One important challenge not addressed in the present study concerns encrypted traffic. In contemporary network environments, encrypted communication is increasingly prevalent, which makes intrusion detection more difficult because visibility into packet content is reduced and detection must rely more heavily on flow-level and metadata-based features. Handling encrypted attacks was outside the scope of the work presented here, which focused on evaluating UNAD+ on benchmark datasets
under the current feature space. Future work will therefore examine whether stronger flow-level, timing-based, and temporal descriptors can improve detection performance under encrypted traffic conditions, particularly in reducing false positives, while preserving the framework’s interpretability.
6 Conclusions This paper presented UNAD+, an enhanced intrusion detection framework designed to address three limi-
14
Saif Alzubi, Frederic Stahl
(a) Decision Tree surrogate for CICIDS2017.
(b) Decision Tree surrogate for NSL-KDD.
Fig. 9: Decision Tree surrogate models used for global explanation of the refinement classifier on CICIDS2017 and NSL-KDD. tations of the original UNAD: the reliance on simple majority voting, the high false positive rate, and the lack of interpretability. The proposed framework combines a benign-only unsupervised ensemble, a supervised refinement stage trained on pseudo-labelled detections, and a post hoc explainability component. In this way, UNAD+ was designed not only to detect previously unseen attacks, but also to improve the quality of these detections and provide analyst-accessible explanations for its decisions.
The experimental results on CICIDS2017 and NSLKDD showed that the framework achieved strong overall performance. The weighted voting strategy improved the first-stage ensemble by eliminating tied votes and the benign-default bias associated with simple majority voting. At the same time, the supervised refinement stage significantly reduced false positives and improved the final detection results. In particular, the false positive rate was reduced from 11.34% to 0.18% on CICIDS2017 and from 6.37% to 2.77% on NSL-KDD. The full combined
UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
framework achieved F1-scores of 98.31% on CICIDS2017 and 98.25% on NSL-KDD, confirming that integrating weighted ensemble detection with supervised refinement provides a substantial improvement over the original UNAD baseline. The analysis also showed that the benefits of the framework were not limited to aggregate performance. At the class level, the second-stage classifier significantly improved the detection of several difficult classes, including SSH-Patator and DoS Slowhttptest on CICIDS2017, and R2L and U2R on NSL-KDD. At the same time, the results highlighted an important limitation: very rare attack classes remained difficult to improve when only a small number of pseudo-labelled instances reached the supervised stage. This indicates that the effectiveness of the refinement component depends not only on classifier design, but also on the availability of sufficiently informative detections from the first stage. A further contribution of this work lies in the integration of explainability into the IDS pipeline. The local explanation layer showed that the refinement classifier relied on meaningful traffic features in representative cases, while the global surrogate model reproduced its broader behaviour with high fidelity. As a result, the framework supports not only detection, but also interpretation, auditing, and debugging. This is particularly relevant in security-critical environments where model transparency is necessary for analyst trust and realworld use. Overall, the findings show that UNAD+ provides a coherent framework for detecting unknown network attacks by combining unsupervised anomaly detection, supervised refinement, and explainable decision support. The framework improves detection performance, reduces false positives, and enhances transparency, making it a more usable and reliable extension of the original UNAD. Future work should focus on encrypted traffic, particularly on whether stronger flow-level, timing-based, and temporal descriptors can improve detection performance and reduce false positives when visibility into packet content is limited. Acknowledgements This work was partially funded by Zukunft.Niedersachsen (ZN4365).
Conflict of interest The authors declare that they have no conflict of interest. References 1. Ashima Chawla, Brian Lee, Sheila Fallon, and Paul Jacob. Host based intrusion detection system with combined
15
CNN/RNN model. In ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Dublin, Ireland, September 10-14, 2018, Proceedings, volume 11329 of Lecture Notes in Computer Science, pages 149–158. Springer, 2018. 2. Syed Usman Shaukat, Saad Khan, and Simon Parkinson. A review on multi-step attack detection. IEEE Access, 13:161779–161805, 2025. 3. Qianwei Meng, Jing Tao, Qingjun Yuan, Guangsong Li, Yongjuan Wang, Bing Gao, and Siqi Lu. Detection of unknown attacks through encrypted traffic: A gaussian prototype-aided variational autoencoder framework. IEEE Transactions on Information Forensics and Security, 20:10652–10667, 2025. 4. Andrea Pinto, Luis-Carlos Herrera, Yezid Donoso, and Jairo A Gutierrez. Survey on intrusion detection systems based on machine learning techniques for the protection of critical infrastructure. Sensors, 23(5):2415, 2023. 5. Alireza Zohourian, Sajjad Dadkhah, Heather Molyneaux, Euclides Carlos Pinto Neto, and Ali A. Ghorbani. Iotprids: Leveraging packet representations for intrusion detection in iot networks. Computers & Security, 146:104034, 2024. 6. Rasheed Ahmad, Izzat Alsmadi, Wasim Alhamdani, and Lo’ai Tawalbeh. A deep learning ensemble approach to detecting unknown network attacks. Journal of Information Security and Applications, 67:103196, 2022. 7. Tommaso Zoppi, Andrea Ceccarelli, Tommaso Puccetti, and Andrea Bondavalli. Which algorithm can detect unknown attacks? comparison of supervised, unsupervised and meta-learning algorithms for intrusion detection. Computers & Security, 127:103107, 2023. 8. Jianheng Tong and Ying Zhang. A real-time label-free selfsupervised deep learning intrusion detection for handling new type and few-shot attacks in iot networks. IEEE Internet of Things Journal, 2024. 9. Paulo Freitas de Araujo-Filho, Mohamed Naili, Georges Kaddoum, Emmanuel Thepie Fapi, and Zhongwen Zhu. Unsupervised gan-based intrusion detection system using temporal convolutional networks and self-attention. IEEE Transactions on Network and Service Management, 20(4):4951–4963, 2023. 10. Lars Nolle, Frederic Stahl, and Tarek El-Mihoub. On explanations for hybrid artificial intelligence. In International Conference on Innovative Techniques and Applications of Artificial Intelligence, pages 3–15. Springer, 2023. 11. Vikas Hassija, Vinay Chamola, Atmesh Mahapatra, Abhinandan Singal, Divyansh Goel, Kaizhu Huang, Simone Scardapane, Indro Spinelli, Mufti Mahmud, and Amir Hussain. Interpreting black-box models: a review on explainable artificial intelligence. Cognitive Computation, 16(1):45–74, 2024. 12. David Gunning and David W. Aha. Darpa’s explainable artificial intelligence (XAI) program. AI Mag., 40(2):44– 58, 2019. 13. Saif Alzubi, Frederic T. Stahl, and Mohamed Medhat Gaber. Towards intrusion detection of previously unknown network attacks. In Khalid Al-Begain, Mauro Iacono, Lelio Campanile, and Andrzej Bargiela, editors, Proceedings of the 35th International ECMS International Conference on Modelling and Simulation, ECMS 2021, Virtual Event, UK, May 31 - June 2, 2021, pages 35–41. European Council for Modeling and Simulation, 2021. 14. Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani. Toward generating a new intrusion detection
16 dataset and intrusion traffic characterization. In Paolo Mori, Steven Furnell, and Olivier Camp, editors, Proceedings of the 4th International Conference on Information Systems Security and Privacy, ICISSP 2018, Funchal, Madeira - Portugal, January 22-24, 2018, pages 108–116. SciTePress, 2018. 15. Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A Ghorbani. A detailed analysis of the kdd cup 99 data set. In 2009 IEEE symposium on computational intelligence for security and defense applications, pages 1–6. Ieee, 2009. 16. Siamak Parhizkari. Anomaly detection in intrusion detection systems. In Anomaly Detection-Recent Advances, AI and ML Perspectives and Applications. IntechOpen, 2023. 17. Yubo Hou, Sin G Teo, Zhenghua Chen, Min Wu, CheeKeong Kwoh, and Tram Truong-Huu. Handling labeled data insufficiency: Semi-supervised learning with selftraining mixup decision tree for classification of network attacking traffic. IEEE Transactions on Dependable and Secure Computing, 2022. 18. Antonia Nisioti, Alexios Mylonas, Paul D Yoo, and Vasilios Katos. From intrusion detection to attacker attribution: A comprehensive survey of unsupervised methods. IEEE Communications Surveys & Tutorials, 20(4):3369–3388, 2018. 19. Ji Qiu, Hongmei Shi, Yuhen Hu, and Zujun Yu. Unraveling false positives in unsupervised defect detection models: A study on anomaly-free training datasets. Sensors, 23(23):9360, 2023. 20. Sabrine Ennaji, Fabio de Gaspari, Dorjan Hitaj, Alicia Kbidi, and Luigi Vincenzo Mancini. Adversarial challenges in network intrusion detection systems: Research insights and future prospects. IEEE Access, 13:148613–148645, 2025. 21. Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolationbased anomaly detection. ACM Trans. Knowl. Discov. Data, 6(1):3:1–3:39, 2012. 22. Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. Lof: identifying density-based local outliers. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pages 93–104, 2000. 23. Omer Sagi and Lior Rokach. Ensemble learning: A survey. Wiley interdisciplinary reviews: data mining and knowledge discovery, 8(4):e1249, 2018. 24. Nadim Ibrahim, NR Rajalakshmi, V Sivakumar, and L Sharmila. An optimized hybrid ensemble machine learning model combining multiple classifiers for detecting advanced persistent threats in networks. Journal of Big Data, 12(1):212, 2025. 25. Arpita Srivastava and Ditipriya Sinha. Arlhnids-iot: An accurate and robust lightweight hybrid-nids for iot network security. Computers & Security, 156:104515, 2025. 26. Suha Cheng and Xu Feng. Ensemble-based detection of distributed denial-of-service attacks in iot networks using majority decision mechanisms. Scientific Reports, 2026. 27. Zeinab Awad, Magdy Zakaria, and Rasha Hassan. An enhanced ensemble defense framework for boosting adversarial robustness of intrusion detection systems. Scientific Reports, 15(1):14177, 2025. 28. Alaa Alhowaide, Izzat Alsmadi, and Jian Tang. Ensemble detection model for iot ids. Internet of Things, 16:100435, 2021. 29. Tommaso Zoppi and Andrea Ceccarelli. Prepare for trouble and make it double! supervised–unsupervised stacking
Saif Alzubi, Frederic Stahl for anomaly-based intrusion detection. Journal of Network and Computer Applications, 189:103106, 2021. 30. Rahul Kale, Zhi Lu, Kar Wai Fok, and Vrizlynn LL Thing. A hybrid deep learning anomaly detection framework for intrusion detection. In 2022 IEEE 8th Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and Smart Computing,(HPSC) and IEEE Intl Conference on Intelligent Data and Security (IDS), pages 137–142. IEEE, 2022. 31. Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. ” why should i trust you?” explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1135–1144, 2016. 32. Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. In Isabelle Guyon, Ulrike von Luxburg, Samy Bengio, Hanna M. Wallach, Rob Fergus, S. V. N. Vishwanathan, and Roman Garnett, editors, Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pages 4765–4774, 2017. 33. Diogo Gaspar, Paulo Silva, and Catarina Silva. Explainable ai for intrusion detection systems: Lime and shap applicability on multi-layer perceptron. IEEE Access, 12:30164–30175, 2024. 34. Osvaldo Arreche, Tanish R Guntur, Jack W Roberts, and Mustafa Abdallah. E-xai: Evaluating black-box explainable ai frameworks for network intrusion detection. IEEE Access, 12:23954–23988, 2024. 35. Vanlalruata Hnamte, Hong Nhung-Nguyen, Jamal Hussain, and Yong Hwa-Kim. A novel two-stage deep learning model for network intrusion detection: Lstm-ae. Ieee Access, 11:37131–37148, 2023. 36. Saif Alzubi, Frederic Stahl, and Mohammed Al-Khafajiy. Detect, decide, explain: An intelligent framework for zeroday network attack detection. In Max Bramer and Frederic Stahl, editors, Artificial Intelligence XLII, pages 3–17, Cham, 2026. Springer Nature Switzerland. 37. Hervé Abdi and Lynne J Williams. Principal component analysis. Wiley interdisciplinary reviews: computational statistics, 2(4):433–459, 2010. 38. Leo Breiman. Bagging predictors. Machine learning, 24(2):123–140, 1996. 39. Nitesh V. Chawla, Kevin W. Bowyer, Lawrence O. Hall, and W. Philip Kegelmeyer. SMOTE: synthetic minority over-sampling technique. J. Artif. Intell. Res., 16:321–357, 2002. 40. Erblin Halabaku and Eliot Bytyçi. Overfitting in machine learning: A comparative analysis of decision trees and random forests. Intelligent Automation & Soft Computing, 39(6), 2024. 41. Massimo Aria, Corrado Cuccurullo, and Agostino Gnasso. A comparison among interpretative proposals for random forests. Machine Learning with Applications, 6:100094, 2021. 42. Kjersti Aas, Martin Jullum, and Anders Løland. Explaining individual predictions when features are dependent: More accurate approximations to shapley values. Artif. Intell., 298:103502, 2021. 43. Julia Herbinger, Susanne Dandl, Fiona K Ewald, Sofia Loibl, and Giuseppe Casalicchio. Leveraging model-based trees as interpretable surrogate models for model distillation. In European Conference on Artificial Intelligence, pages 232–249. Springer, 2023.