CyberShield analytics: SHAP-guided stacking ensembles for organizational risk resilience

The escalating sophistication of cyber threats against organizational infrastructure demands detection frameworks that simultaneously achieve high classification performance, statistical robustness, and operational transparency. Most published intrusion detection frameworks optimize for accuracy alone, omitting leakage-free evaluation protocols, formal significance testing, and the auditable explanations required by contemporary AI governance frameworks.

This paper presents CyberShield Analytics, a SHAP-guided two-level stacking ensemble framework for network intrusion detection and organizational risk resilience. The study addresses the binary intrusion-detection task (Attack vs. Normal); the 10 underlying traffic categories of the dataset are used only for exploratory characterization and are not predicted as separate classes. Evaluated on the benchmark UNSW-NB15 dataset comprising 257,673 network flow records, the framework integrates nine heterogeneous base learners-Logistic Regression, Decision Tree, Random Forest, Extra Trees, Gradient Boosting, XGBoost, LightGBM, Multilayer Perceptron, and K-Nearest Neighbors-with an XGBoost meta-learner operating on leakage-free out-of-fold probability estimates. A systematic feature engineering pipeline expands the original 45-feature space to 67 dimensions through 22 domain-informed interaction and transformation features.

The ensemble achieves Accuracy = 0.9535, F ₁ = 0.9535, and AUC-ROC = 0.9929 on a fully held-out test set of 51,535 instances, outperforming all individual base learners. Statistical validity is confirmed via 5-Fold Stratified Cross-Validation (mean F ₁ = 0.9499 ± 0.0013), with paired t-tests showing significant superiority over XGBoost (t = 7.165, p = 0.002), LightGBM (t = 25.108, p < 0.0001), and Extra Trees (t = 3.178, p = 0.034). Error evaluation confirms the lowest MAE (0.04653) and RMSE (0.21571) among all evaluated models. A tri-method Explainable AI (XAI) layer comprising SHAP, DeepLIFT, and Integrated Gradients applied to representative base learners consistently identifies sttl, ct_dst_sport_ltm, and byte_ratio as the dominant threat-discriminating features.

The CyberShield framework bridges the critical gap between predictive performance and operational explainability. Improvements should be read as gains in robustness, calibration, and statistical reliability at comparable accuracy rather than a headline accuracy increase. The framework offers actionable threat intelligence for Security Operations Centers (SOCs) and cyber risk governance in enterprise environments.