Article 2026-04-21 under-review v1

Explainable Transformer-Based Intrusion Detection with Hybrid Data Balancing

A
Ahmed Elsayed Abdelfattah Arab Academy for Science, Technology and Maritime Transport
M
Mohamed Seifeldin Arab Academy for Science, Technology and Maritime Transport
M
Mohamed Mostafa Fouad Arab Academy for Science, Technology and Maritime Transport

Abstract

Network intrusion detection systems play a vital role in safeguarding digital infrastructure. Still, significant challenges persist due to the highly imbalanced nature of network traffic and the lack of interpretability in many machine learning models. This research introduces an explainable deep learning framework for multi-class intrusion detection that utilizes tabular network flow data. The suggested method incorporates a transformer-based architecture tailored to tabular data, along with a hybrid data-balancing strategy that combines reservoir-based sampling and synthetic minority oversampling to address severe class imbalance. The model is evaluated on the CICIDS2018 dataset, employing a stratified approach for the training, validation, and test splits. Results indicate excellent overall detection capabilities, achieving approximately 97% in both weighted accuracy and F1-score across various attack categories. The system is particularly effective at detecting several high-volume attack types while maintaining strong performance across most minority classes. To enhance model transparency, SHAP-based explainability techniques are used to quantify feature contributions and uncover patterns associated with different attack types. The explainability analysis highlights critical network flow features that influence classification outcomes and provides interpretable insights to help security analysts understand the model's behavior. The results suggest that merging transformer-based models with balanced data preprocessing and explainable artificial intelligence can improve both the predictive accuracy and interpretability of intrusion detection systems. This framework illustrates the potential of deep learning techniques to bolster more transparent and effective cybersecurity monitoring in intricate network environments.

Citation Information

@article{ahmedelsayedabdelfattah2026,
  title={Explainable Transformer-Based Intrusion Detection with Hybrid Data Balancing},
  author={Ahmed Elsayed Abdelfattah and Mohamed Seifeldin and Mohamed Mostafa Fouad},
  journal={Scientific Reports},
  year={2026},
  doi={https://doi.org/10.21203/rs.3.rs-9108130/v1}
}
Back to Top
Home
Paper List
Submit
0.023810s