Intrinsic and Post-Hoc Explainability for Anomaly Detection in Network Intrusion Detection Systems
Year: 2026
Type: conference-paper
Abstract: As cyber threats grow in sophistication, traditional rule-based defences increasingly fail to detect novel attacks, prompting a shift toward deep learning for anomaly-based intrusion detection systems. While transformer architectures have achieved state-of-the-art performance in detecting anomalous signatures in complex, high-dimensional network telemetry, the inherent opacity of neural networks hampers operational adoption, trust, auditability, and compliance. This paper addresses these challenges by presenting a rigorous evaluation of the Anomaly Transformer architecture as intrusion detection systems on modern benchmarks. Crucially, we introduce a purpose-built explainability framework for intrusion detection that unifies model-intrinsic and post-hoc explanations within a time-aware setting. By systematically contrasting the model's attentionbased association mechanism with time-aware KernelSHAP explanations, we observe strong complementarity: while intrinsic mechanisms accurately localize anomalous events in time, posthoc methods identify distinct feature attributions. Our findings highlight that relying on a single explanation modality is insufficient and motivate multifaceted explainability paradigms essential for delivering comprehensive, trustworthy, and actionable explanations in operational cybersecurity contexts. They are intended to support security analysts who require both temporal localization of anomalies and feature-level attribution for postincident auditing and operational trust.
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7163190937