Related Experiment Videos
A method for forensic-ready intrusion detection using explainable learning, prediction-aware graph modeling, and
Sghaier Guizani1,2, Sneha Xavier2,3, Amal Ajayan2,4
1Department of Electrical Engineering, Alfaisal University, Riyadh, Saudi Arabia.
Methodsx
|June 19, 2026
Summary
This study introduces a reproducible intrusion detection workflow integrating data partitioning, preprocessing, Random Forest prediction, explainability (SHAP, LIME), and graph analysis for enhanced cyber defense. The method ensures auditable and verifiable forensic-ready intrusion detection.
Area of Science:
- Cybersecurity
- Data Science
- Network Security
Background:
- Intrusion detection systems (IDS) often lack reproducibility due to fragmented workflows.
- Challenges include undocumented preprocessing, model configuration, and analysis.
- This hinders verification, reuse, and forensic readiness.
Purpose of the Study:
- To present a unified, reproducible, and forensic-ready intrusion detection method.
- To integrate multiple stages of the detection pipeline into a single executable workflow.
- To enhance audibility and verifiability of intrusion detection processes.
Main Methods:
- Developed a leakage-safe stratified partitioning and deterministic preprocessing workflow.
- Implemented Random Forest for multi-class prediction.
- Integrated explainability methods (SHAP, LIME) and prediction-aware interaction graph construction.
- Incorporated counterfactual reasoning (DiCE) for decision-sensitive analysis.
Main Results:
- The complete workflow was implemented on the TON-IoT dataset.
- Reproducible outputs and intermediate artifacts were packaged for verification.
- Demonstrated a unified procedure for building and analyzing intrusion detection systems.
- Enabled graph-based ranking of suspicious nodes and flows.
Conclusions:
- The proposed method provides a unified procedure for building and analyzing intrusion detection systems.
- Achieved explicit control over data partitioning, feature transformation, model behavior, and forensic decision-making.
- Facilitates reproducible forensic and cyber defense studies through artifact-backed outputs.
