ARCHIVES

Intrusion Detection Systems (IDS) play a critical role in monitoring network traffic and identifying malicious activities that threaten digital infrastructure security. Traditional IDS models struggle with accuracy, interpretability, and reliability as cyber-attacks continue to evolve. This study develops an ensemble learning-based IDS that combines Random Forest and XGBoost algorithms through a Voting Classifier to enhance detection performance and stability. The system was trained, validated, and tested on the NSL-KDD benchmark dataset, which underwent preprocessing including encoding, normalization, and feature selection. SHAP (SHapley Additive exPlanations) was integrated to provide feature-level interpretability for each classification, addressing the black-box nature of ensemble models and increasing transparency. The system achieved strong performance with 99.26% training accuracy, 98.97% validation accuracy, and 98.86% test accuracy. SHAP analysis identified key contributing features such as src_bytes, dst_bytes, and flag, enabling deeper understanding of the model’s decision-making process. Comparative analysis with previous ensemble-based IDS studies demonstrated superior performance over CNN-RF hybrids and RF-SVM-LIME explainable ensembles. Overall, the developed IDS represents an accurate and interpretable solution for detecting malicious traffic and supporting informed cybersecurity decisions