Authors: More Srushti Satish, Professor Bangar Abhishek Popat, Professor Bhosale.Sachin Bajirao, Professor Karad Vandana
Abstract: Cyber threats such as denial-of-service attacks, scanning, brute-force attempts, and suspicious network activity create risks for users and organizations. Machine-learning-based intrusion detection can help identify patterns in network traffic, but a supervised model may miss attack types that are not represented in its training data. In addition, a prediction without a clear explanation can be difficult for a security analyst to trust. This paper proposes a small, explainable hybrid framework that combines a supervised classifier, anomaly detection, and feature-level explanations. XGBoost is proposed for classifying known traffic patterns, Isolation Forest for flagging unusual records, and SHAP for explaining selected classifier predictions. A Streamlit dashboard is planned to display predictions, anomaly flags, and evaluation results. The framework will be evaluated using a public intrusion-detection dataset such as CIC-IDS2017. The main research question is whether adding anomaly analysis and explanations improves the usefulness of a basic classifier, while keeping false alarms visible. This paper describes a research proposal and evaluation plan; no experimental performance values are claimed before implementation. SHAP provides feature-level explanations to help users understand the factors influencing classifier predictions. A Streamlit dashboard is planned to display classification results, anomaly flags, and evaluation metrics. The framework will be evaluated using the CIC-IDS2017 dataset, with precision, recall, F1-score, and false-positive rate used to assess its performance. The study aims to investigate whether combining supervised classification, anomaly detection, and explainability provides more useful threat analysis than a basic classifier alone. Experimental results will be reported after implementation and testing.
