<![CDATA[Network intrusion detection requires models that are accurate for imbalanced traffic and interpretable for administrative use. This study develops a web-based explainable intrusion detection prototype using imbalance-aware multiclass XGBoost and SHAP. The CICIDS2017 flow data were processed into 2,231,759 records with 77 numerical features and seven labels: BENIGN, Bot, Brute Force, DDoS, DoS, PortScan, and Web Attack. Data were split using an 80:20 stratified scheme, while balanced sample weights were applied only to the training set. The trained XGBoost model was evaluated using accuracy, macro precision, macro recall, macro F1-score, Matthews correlation coefficient, and confusion matrix. Model interpretation was presented through global SHAP, class-specific SHAP, local SHAP, and false-positive/false-negative analysis on a Flask dashboard. The model achieved 99.91% accuracy, 92.83% macro precision, 98.97% macro recall, 95.30% macro F1-score, and 0.9967 MCC. Functional local prediction testing on seven scenarios produced four correct classifications and three false negatives due to the prototype mode using 12 top SHAP features while imputing the remaining features with training medians. The results show that the proposed prototype can support explainable network intrusion monitoring while still requiring full-feature batch prediction for operational evaluation. Keywords: intrusion detection, XGBoost, SHAP, class imbalance, web dashboard]]>
Copyrights © 2026
