Hybrid Optimization and LSTM-Based Explainable Framework for Adaptive Intrusion Detection
Ganesh Raghu, Qassem Alattabi, Y. M. Mahaboob John, M. Dhanamalar, S. Senthil Kumar · 2025
In recent years, intrusion detection has become a demanding challenge for modern cybersecurity systems, owing to the increasing volume and complexity of network traffic. Traditional models tend to suffer from adaptability and transparency, and struggle to accurately classify evolving threats. In this research, proposes an improved intrusion detection framework a hybrid optimization method with a Long Short-Term Memory (LSTM) network for an adaptive intrusion response. Initially, the network traffic dataset is collected from CICIDS2017 and subjected to a pre-processing step using label encoding for categorical fields and min-max normalization to bring the features to a standard scale. In addition, Convolutional Neural Networks (CNNs) are used for feature extraction to capture relevant spatial patterns from transformed traffic data. The Chimp-Chicken Swarm Optimization (ChCSO) algorithm was used for hyperparameter tuning of the LSTM model and to improve the feature space by balancing exploration and exploitation to improve convergence. The LSTM network models the temporal dependencies in traffic flow and classifies normal and anomalous behaviors. To enhance interpretability and trust, SHapley Additive explanations (SHAP) are combined, offering both global and local feature importance for each detection instance. The proposed LSTM-ChCSO-SHAP achieved better results than the LSTM-ChCSO in terms of accuracy (99.87 %), sensitivity (99.92 %), and specificity (99.98 %).