Jordanian Journal of Informatics and Computing

ISSN: 3080-6828 (Online)

An Explainable AI Framework for Real-Time Cyberattack Detection and Risk Assessment

by 

Vugar Abdullayev ;

Alex Khang ;

Nazila Ragimova

PDF logoPDF

Published: 2026/11/06

Abstract

As cyberattacks become more sophisticated and more common, detection systems must be not only accurate but also quick and easy to interpret. Although deep learning models have proven to be very effective in detecting intrusion and malware, their black-box nature has hindered their adoption in security operations centers (SOCs), where analysts need to explain and take action on alerts in short timeframes. To offer real-time cyberattack detection with quantitative risk assessment, this paper presents an Explainable AI (XAI) framework that integrates a lightweight hybrid deep learning detector with post-hoc and intrinsic explainability methods. The framework combines a Convolutional-Bidirectional Gated Recurrent Unit (CNN-BiGRU) architecture for spatio-temporal traffic representation with an attention layer that highlights salient time steps and integrates SHAP (Shapley Additive explanations) and LIME (Local Interpretable Model-agnostic Explanations) to generate human-readable justifications for every prediction. A dynamic risk-scoring engine then translates detection confidence, feature-level severity, and asset criticality to a normalized risk index that enables prioritized incident response. The framework is tested on three benchmark intrusion detection datasets (CICIDS2017, NSL-KDD, and UNSW-NB15) and a real-time traffic stream generated synthetically. Experimental results reveal that the proposed model achieves a detection accuracy of 98.6%, achieves an F1-score of 0.981, and the average latency of inference is 14.2 milliseconds per flow, and explanation fidelity, based on the two metrics of deletion/insertion and rank-correlation stability, demonstrates that the explanations generated are faithful to the model's behavior. It has been shown that the proposed hybrid framework is suitable for application in real-time network security environments with limited resources, as it outperforms the standalone CNN, LSTM, Random Forest, and CNN-LSTM baselines in terms of detection performance and retains interpretability with only a minor computational cost. It also demonstrates the applicability of the framework for security operations workflows by means of a comprehensive ablation study, ROC and confusion-matrix analysis, and a comparison with the dynamic risk index and static CVSS-style scoring.

Keywords

Explainable AIIntrusion DetectionCybersecurityDeep learningSHAPLIMERisk AssessmentReal-Time DetectionCNN-BiGRUAttention Mechanismand Network Security.

Doi Link

https://doi.org/10.63180/jjic.thestap.2027.1.5

How to Cite the Article

Abdullayev, V., Khang, A., & Ragimova, N. (2026). An Explainable AI Framework for Real-Time Cyberattack Detection and Risk Assessment. Jordanian Journal of Informatics and Computing, 2027(1), 96. https://doi.org/10.63180/jjic.thestap.2027.1.5

An Explainable AI Framework for Real-Time Cyberattack Detection and Risk Assessment is licensed under CC BY 4.0CCBY

References

  1. Ahmad, Z., Shahid Khan, A., Wai Shiang, C., Abdullah, J., & Ahmad, F. (2020). Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32(1). Portico. https://doi.org/10.1002/ett.4150
  2. Lundberg, S. M., & Lee, S. I. (2017). A unified approach to interpreting model predictions. Advances in neural information processing systems, 30. doi.org/10.48550/arxiv.1705.07874
  3. Ribeiro, M., Singh, S., & Guestrin, C. (2016). “Why Should I Trust You?”: Explaining the Predictions of Any Classifier. Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Demonstrations, 97–101. https://doi.org/10.18653/v1/n16-3020
  4. Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A. (2018). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy, 108–116. https://doi.org/10.5220/0006639801080116
  5. Moustafa, N., & Slay, J. (2015). UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). 2015 Military Communications and Information Systems Conference (MilCIS), 1–6. https://doi.org/10.1109/milcis.2015.7348942
  6. Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009). A detailed analysis of the KDD CUP 99 data set. 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, 1–6. https://doi.org/10.1109/cisda.2009.5356528
  7. Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., & Venkatraman, S. (2019). Deep Learning Approach for Intelligent Intrusion Detection System. IEEE Access, 7, 41525–41550. https://doi.org/10.1109/access.2019.2895334
  8. Wang, M., Zheng, K., Yang, Y., & Wang, X. (2020). An Explainable Machine Learning Framework for Intrusion Detection Systems. IEEE Access, 8, 73127–73141. https://doi.org/10.1109/access.2020.2988359
  9. Mahbooba, B., Timilsina, M., Sahal, R., & Serrano, M. (2021). Explainable Artificial Intelligence (XAI) to Enhance Trust Management in Intrusion Detection Systems Using Decision Tree Model. Complexity, 2021(1). Portico. https://doi.org/10.1155/2021/6634811
  10. Barredo Arrieta, A., Díaz-Rodríguez, N., Del Ser, J., Bennetot, A., Tabik, S., Barbado, A., Garcia, S., Gil-Lopez, S., Molina, D., Benjamins, R., Chatila, R., & Herrera, F. (2020). Explainable Artificial Intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI. Information Fusion, 58, 82–115. https://doi.org/10.1016/j.inffus.2019.12.012
  11. Marino, D. L., Wickramasinghe, C. S., & Manic, M. (2018). An Adversarial Approach for Explainable AI in Intrusion Detection Systems. IECON 2018 - 44th Annual Conference of the IEEE Industrial Electronics Society, 3237–3243. https://doi.org/10.1109/iecon.2018.8591457
  12. Kwon, D., Kim, H., Kim, J., Suh, S. C., Kim, I., & Kim, K. J. (2017). A survey of deep learning-based network anomaly detection. Cluster Computing, 22(S1), 949–961. https://doi.org/10.1007/s10586-017-1117-8
  13. Buczak, A. L., & Guven, E. (2016). A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection. IEEE Communications Surveys &Amp; Tutorials, 18(2), 1153–1176. https://doi.org/10.1109/comst.2015.2494502
  14. Kim, J., Kim, J., Kim, H., Shim, M., & Choi, E. (2020). CNN-Based Network Intrusion Detection against Denial-of-Service Attacks. Electronics, 9(6), 916. https://doi.org/10.3390/electronics9060916
  15. Chawla, N. V., Bowyer, K. W., Hall, L. O., & Kegelmeyer, W. P. (2002). SMOTE: Synthetic Minority Over-sampling Technique. Journal of Artificial Intelligence Research, 16, 321–357. https://doi.org/10.1613/jair.953
  16. Otoum, S., Kantarci, B., & Mouftah, H. T. (2019). On the Feasibility of Deep Learning in Sensor Network Intrusion Detection. IEEE Networking Letters, 1(2), 68–71. https://doi.org/10.1109/lnet.2019.2901792
  17. Alshabibi, M. (2025). A systematic review of cyber security threats in Cloud Computing. International Journal of Cybersecurity Engineering and Innovation, 2025(1).
  18. Schlette, D., Caselli, M., & Pernul, G. (2021). A Comparative Study on Cyber Threat Intelligence: The Security Incident Response Perspective. IEEE Communications Surveys &Amp; Tutorials, 23(4), 2525–2556. https://doi.org/10.1109/comst.2021.3117338
  19. Apruzzese, G., Colajanni, M., Ferretti, L., Guido, A., & Marchetti, M. (2018). On the effectiveness of machine and deep learning for cyber security. 2018 10th International Conference on Cyber Conflict (CyCon), 371–390. https://doi.org/10.23919/cycon.2018.8405026
  20. Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., & Bengio, Y. (2014). Learning Phrase Representations using RNN Encoder–Decoder for Statistical Machine Translation. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), 1724–1734. https://doi.org/10.3115/v1/d14-1179
  21. Hochreiter, S., & Schmidhuber, J. (1997). Long Short-Term Memory. Neural Computation, 9(8), 1735–1780. https://doi.org/10.1162/neco.1997.9.8.1735
  22. Sarhan, M., Layeghy, S., & Portmann, M. (2021). Towards a Standard Feature Set for Network Intrusion Detection System Datasets. Mobile Networks and Applications, 27(1), 357–370. https://doi.org/10.1007/s11036-021-01843-0
  23. Capuano, N., Fenza, G., Loia, V., & Stanzione, C. (2022). Explainable Artificial Intelligence in CyberSecurity: A Survey. IEEE Access, 10, 93575–93600. https://doi.org/10.1109/access.2022.3204171
  24. Neupane, S., Ables, J., Anderson, W., Mittal, S., Rahimi, S., Banicescu, I., & Seale, M. (2022). Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities. IEEE Access, 10, 112392–112415. https://doi.org/10.1109/access.2022.3216617
  25. Almaiah, M. A., & Ghanem, M. C. (2026). Deep Learning-Based Adaptive Intrusion Detection for Next-Generation Network Security. Journal of Information and Cybersecurity, 2026(1), 16-31.