Intrusion Detection System Using Ensemble Learning and SHAP Explainability

DOI

https://www.doi.org/10.59256/ijire.20260702029

Published In

Volume 7, Issue 2 (2026)

Published Online

March-April 2026

Pages

239-243

Article Type

Original Article

Check for updates

Intrusion Detection Systems (IDS) play a critical role in monitoring network traffic and identifying malicious activities that threaten digital infrastructure security. Traditional IDS models struggle with accuracy, interpretability, and reliability as cyber-attacks continue to evolve. This study develops an ensemble learning-based IDS that combines Random Forest and XGBoost algorithms through a Voting Classifier to enhance detection performance and stability. The system was trained, validated, and tested on the NSL-KDD benchmark dataset, which underwent preprocessing including encoding, normalization, and feature selection. SHAP (SHapley Additive exPlanations) was integrated to provide feature-level interpretability for each classification, addressing the black-box nature of ensemble models and increasing transparency. The system achieved strong performance with 99.26% training accuracy, 98.97% validation accuracy, and 98.86% test accuracy. SHAP analysis identified key contributing features such as src_bytes, dst_bytes, and flag, enabling deeper understanding of the model’s decision-making process. Comparative analysis with previous ensemble-based IDS studies demonstrated superior performance over CNN-RF hybrids and RF-SVM-LIME explainable ensembles. Overall, the developed IDS represents an accurate and interpretable solution for detecting malicious traffic and supporting informed cybersecurity decisions