ProEn-XAI: A High-Precision IDS Model for Zero-Day Attack Detection Using Hybrid Deep Learning and SHAP-LIME Interpretability

Abstract

The rapid evolution of cyber threats, especially zero-day attacks, presents a formidable challenge to conventional intrusion detection systems (IDS). To address this, we propose ProEn-XAI: A High-Precision IDS Model for Zero-Day Attack Detection Using Hybrid Deep Learning and SHAP-LIME Interpretability. The model introduces a novel ensemble framework that integrates three complementary learners: a Weighted Truncated Multi-Layer Perceptron (MLP), a Bi-GRU network with an attention mechanism, and XGBoost, with outputs fused through a Logistic Regression meta-learner. This hybrid approach captures spatial and sequential features of network traffic while maintaining robustness to class imbalance and noise.The system is evaluated on the KDD99 benchmark dataset, where it achieves a remarkable accuracy of 99.78%, along with macro and weighted F1-scores of 0.9971 and 0.9977, respectively. Notably, the model demonstrates high classification performance even on low-frequency and rare attack classes such as Buffer Overflow, Warezclient, and Rootkit, where existing models tend to fail. To ensure interpretability, we integrate SHAP (for global explanation) and LIME (for local instance-level explanation), enabling transparent decision-making and trustworthiness in cybersecurity operations.ProEn-XAI thus offers a powerful, interpretable, and scalable IDS solution capable of detecting both known and unknown attack types. The combination of deep learning, ensemble fusion, and XAI mechanisms makes it a viable candidate for modern, high-risk network environments facing zero-day threats.