A method for forensic-ready intrusion detection using explainable learning, prediction-aware graph modeling, and...

Intrusion detection pipelines often achieve strong predictive performance, yet many remain difficult to reproduce because preprocessing, model configuration, explainability integration, graph construction, and decision analysis are not documented as a unified, auditable workflow. This article presents a reproducible method for forensic-ready intrusion detection that integrates leakage-safe stratified partitioning, deterministic preprocessing, Random Forest-based multi-class prediction, explainability via SHAP and LIME, prediction-aware interaction graph construction, graph-based node and flow ranking, and counterfactual reasoning within a single executable pipeline. The method was implemented on the benchmark TON-IoT dataset, and the complete workflow was packaged with reproducible outputs and intermediate artifacts supporting verification and reuse. By combining predictive modeling, explainability, structural graph reasoning, and intervention-oriented counterfactual analysis, the proposed method provides a unified procedure for building and analyzing intrusion detection systems, with explicit control over data partitioning, feature transformation, model behavior, and forensic decision-making. • A leakage-safe intrusion detection workflow was developed using stratified train-test partitioning with strict separation of contextual identifiers from predictive features and deterministic preprocessing for reproducible model training. • A prediction-aware analytical framework was constructed by integrating SHAP and LIME-based explainability, hybrid suspicion scoring, and directed interaction graph modeling to enable graph-based ranking of suspicious nodes and flows. • Counterfactual reasoning using DiCE was incorporated to analyze decision-sensitive feature perturbations, and the complete pipeline was released with artifact-backed outputs to support reproducible forensic and cyber defense studies.