Received 4 April 2025, accepted 27 May 2025, date of publication 3 July 2025, date of current version 10 July 2025.

Digital Object Identifier 10.1109/ACCESS.2025.3585783

Explainable AI Meets Synthetic Data: A Deep

Learning Framework for Detecting Network
Intrusion in NextG Network Infrastructure
MD JUNAYED HOSSAIN 1 , KHORSHED ALAM 1 , (Member, IEEE),
MD FAHAD MONIR1 , (Member, IEEE), MD MOZAMMAL HOQUE 2 , (Member, IEEE),
AND TAREM AHMED 1 , (Senior Member, IEEE)
1 Department of Computer Science and Engineering (CSE), Independent University Bangladesh, Dhaka 1229, Bangladesh
2 Agni Systems Ltd., Dhaka 1212, Bangladesh
Corresponding author: Tarem Ahmed (tarem@[Link])

ABSTRACT In today’s digitally driven world, network security has become a top accountability as
cyberattacks become more sophisticated, especially within emerging NextG network infrastructures.
Advanced threats, including as zero-day exploits, polymorphic malware, and large-scale distributed denial-
of-service (DDoS) attacks, have surpassed traditional Network Intrusion Detection Systems (NIDS), which
frequently use out-of-date signature-based methodologies. These conventional methods not only struggle to
detect unknown attack patterns but are also hindered by the issue of imbalanced datasets, where minority
attack classes are underrepresented and frequently overlooked. To address these challenges, we proposes an
innovative NIDS framework tailored for NextG networks that combines Generative Adversarial Networks
(GANs) with Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) models.
The framework utilizes GANs to generate synthetic samples for minority classes, ensuring a balanced
dataset and enhancing the detection of underrepresented attack types. The CNN and LSTM models,
applied independently, leverage their respective strengths to extract spatial and temporal features from
network traffic, achieving robust classification accuracy. Furthermore, we integrate Local Interpretable
Model-Agnostic Explanations (LIME) to make model predictions transparent, increasing trust and usability
for practical deployment. Our framework is evaluated on the NF-CSE-CIC-IDS2018 dataset and achieves
outstanding results. The LSTM model attains a detection accuracy of 99.67%, while CNN achieves 97.45%.
On this GitHub Repository: [Link] the
entire data analysis and prediction method is available for use by anyone. Here, both models perform
exceptionally well in detecting minority attack classes, with the LSTM showing superior consistency across
all metrics. This framework’s high accuracy, explainability, and adaptability make it a critical tool for
securing dynamic and high-speed NextG networks against evolving cyber threats.

INDEX TERMS Intrusion detection, GANs imputation, LSTM, CNN, LIME, XAI, SDG 9, SDG 16.

I. INTRODUCTION data transfer, NIDS is one of the important layers of defense

Network Intrusion Detection Systems (NIDS) are highly mechanism that is required against ever-sophisticated cyber
instrumental in enforcing the security and resilience of threats [1]. With the advancement of technologies like NextG
computer networks shown in Figure: 1. In modern times, networks, the need for strong security systems has become
where the networks are the backbone of communication and more critical than ever. NextG networks promise ultra-low
latency, high bandwidth, decentralized architectures, and the
The associate editor coordinating the review of this manuscript and ability to connect billions of IoT devices, making them
approving it for publication was Salekul Islam . transformative for industries like healthcare, transportation,

2025 The Authors. This work is licensed under a Creative Commons Attribution 4.0 License.
VOLUME 13, 2025 For more information, see [Link] 114979
 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

and smart cities. However, these advancements come with

significant security challenges. The fast, complex, and
diverse nature of data traffic in NextG networks creates
a larger attack surface, exposing them to advanced cyber
threats such as zero-day exploits, polymorphic malware, and
distributed denial-of-service (DDoS) attacks [2]. To mitigate
these risks, NIDS serve as a vital layer of defense. They
monitor network traffic, analyze data packets in real-time,
and detect potentially malicious activities by identifying pat-
FIGURE 1. A diagram illustrating the components of a traditional NIDS
terns, anomalies, or known signatures, providing an essential framework and the flow of network traffic to a protected LAN.
early warning against evolving cyber threats. By doing so,
NIDS is an early warning mechanism that can keep network
administrators ahead of such potential disasters before severe With this in mind, the importance of this research in the
damage has occurred or before the breach was obvious [3]. field of network security cannot be overemphasized, as cyber
Unlike firewalls or antivirus systems, which typically depend threats are advancing day by day. The more reliance on digital
on predefined rules or signatures of known threats, NIDS infrastructure within businesses, governments, healthcare,
can detect new forms of threats by their deviation from a and other critical sectors like energy, the more important
normal pattern of behavior. Thus, NIDS are pretty potent it is to ensure that the networks are safe from bad actors.
in uncovering zero-day vulnerabilities. These systems help Network security research is focused on securing not only
ensure the confidentiality, integrity, and availability of data the channels of communication but also the systems and
by preventing malicious DoS, unauthorized access, malware data flowing through them from various forms of attack,
injections, and insider threats. As networks grow increasingly such as breaches, DDoS, ransomware, among others [5].
in complexity, NIDS must scale up and also become more Despite this, the cyber threat landscape has continued to
sophisticated as the emerging threats do. be very fluid. With the surfacing of new techniques of
The importance of research into NIDS has particular attack each day, the proliferation of IoT devices, cloud
relevance with every passing day, since cyber threats are computing, and edge networks has also introduced new
dynamic in nature. Attackers continue to devise novel ways of vulnerabilities. Unlike other fields, where high performance
evading detection by traditional security mechanisms, which may be attained with 99% accuracy, in network security,
are mostly signature-based in nature, including antivirus a small margin of error can mean disastrous breaches.
software and firewalls. Thus, modern NIDS needs to be Thus, research becomes important in developing more safe
more robust, adaptive, and intelligent in identifying known and dependable systems to answer these dynamic threat
and unknown threats [4]. This is particularly essential at patterns. Besides, research into network security will have
times when the attackers utilize polymorphic malware, zero- to keep up with the newest technologies−5G, quantum
day exploits, or APTs that bypass traditional signature-based computing, and blockchain-offering both new opportunities
methods of detection. and risks at the same time. For example, quantum computing
Among the big issues in research into NIDS, there is can render today’s encryption methods obsolete, and 5G
a need to minimize false positives that flag legitimate networks introduce new points of vulnerability due to
traffic as malicious, and false negatives where real threats their decentralized architecture. Keeping pace with such
are not caught. Although various studies from different technological advancements naturally requires continued
schools of thought demonstrated various NIDS, achieving investment in research to anticipate future threats and develop
accuracy rates as high as 95 − 99% on benchmark datasets, pre-emptive solutions accordingly.
the results often fail to generalize in real-world scenarios DL, a subset of ML based on Artificial Neural Networks
with newly emerging attack vectors. In general, over- (ANNs), has proven to be highly effective in numerous
reliance on old datasets and methodologies may result in fields due to its ability to learn complex patterns and
vulnerabilities within evolving environments. In light of relationships from vast amounts of data [6], [7]. When
the rapid advancement of techniques within cyber-attacks, applied to NIDS, deep learning offers several key advantages
it is vital that new methods are under constant development over traditional rule-based or shallow learning methods.
whereby novel and increasingly sophisticated threats can be These benefits make it a promising avenue for improving
recognized. The demand for research on NIDS lies not only the detection of both known and unknown cyber threats.
in enhancing accuracy but also in response times, scalability Below, we explain how deep learning can enhance NIDS,
for larger and more complex networks, and adaptability to supported by solid facts and theories from computer science
encrypted traffic. Also, the integration of Machine Learning and cybersecurity. Large volumes of data are generated
(ML) and Artificial Intelligence (AI) within NIDS seems to by modern networks, which can be highly complex and
be a promising direction, since these technologies can make multi-dimensional in nature. Each network traffic contains a
the system learn from labeled and unlabeled data for better host of diverse features such as IP addresses, ports, packet
detection, with fewer human interventions. sizes, time intervals, protocols, and payloads. Traditional

114980 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

NIDS handles this complexity poorly because the feature set model’s decision-making process. LIME highlights
was manually selected or signature-based detection, subtle feature importance, explaining how critical attributes
patterns and correlations between features tend to get missed. like packet count, protocol type, and flow duration
Deep learning models, especially DNNs, are inherently influence predictions, enhancing trust and usability.
good at dealing with high-dimensional data because of their The rest of the paper is organized as follows: Section II
hierarchical structure [8]. They can also learn important provides the background of the study. Section III reviews
features automatically from raw data with no need for related works, while Section IV details the proposed
manual feature engineering. This is especially crucial for methodology. Section V presents performance evaluation,
NIDS, considering the complex nonlinear behaviors modern and Section VI discusses potential applications. Deployment
cyber-attacks can take. For example, Convolutional Neural strategies and hardware considerations are outlined in
Networks (CNNs) [9] and RNNs [10] show considerable Sections VII and VIII, followed by performance trade-offs
success in finding patterns and sequences from network in Section IX. Finally, Section X concludes with limitations
traffic data where several features are interacting in a very and future directions.
complicated way.
In this study, we utilized CNNs and LSTMs to predict II. BACKGROUND
eight types of intrusions using the NF-CSE-CIC-IDS2018 This section provides a contextual overview of the topics
dataset. To address the inherent imbalance in the dataset, relevant to our research, tailored for readers from fields other
we employed GANs to generate synthetic data for underrep- than computer science and network security.
resented classes, ensuring a balanced dataset. Furthermore,
we applied Local Interpretable Model-Agnostic Explanations
A. NETWORK INTRUSION DETECTION SYSTEM (NIDS)
(LIME) [35] to interpret model predictions, providing
A NIDS monitors and analyzes network traffic to detect
valuable insights into the decision-making processes of our
potential threats or policy violations [11]. It employs two
models. The complete data analysis and prediction models are
key detection methods: signature-based, which identifies
available in this GitHub Repository: [Link]
threats using known patterns, and anomaly-based, which
am-junayed/XAI-Intrusion-Detection-System. Also the
detects deviations from established normal behavior. NIDS
balanced dataset, generated using GAN, can also be accessed
alerts administrators to threats and can respond in real-time
in this Balanced Dataset folder. Since the NF-CSE-CIC-
to prevent damage, playing a crucial role in safeguarding
IDS2018 dataset is large and balancing it requires significant
networks against cyber threats, unauthorized access, and
computational resources, this balanced dataset will help
security breaches.
future researchers work with it without the high computa-
tional cost. The contribution of our work is stated below:
• Integration of GAN with for NIDS: The paper B. CONVOLUTIONAL NEURAL NETWORK (CNN)
introduces a novel Network Intrusion Detection System A Convolutional Neural Network (CNN) is a type of deep
(NIDS) framework that leverages a Generative Adver- learning model designed specifically to process structured
sarial Network (GAN) [37] to address the class imbal- data. CNNs are a specialized kind of artificial neural network
ance problem and applied Long Short-Term Memory that excel in identifying patterns and features in data through
(LSTM) [36] and CNN for accurate intrusion detection. a series of layers that simulate how the human brain processes
This integrated approach enhances the detection of visual information. In the context of NIDS, it works by
minority-class intrusions, which are often underrepre- converting network traffic data into a format compatible
sented in traditional datasets. with CNNs, typically through feature extraction techniques
• Independent Application of LSTM and CNN: This that represent traffic characteristics as matrices [12]. These
research explores the performance of LSTM and matrices allow CNNs to process and identify distinct patterns
Convolutional Neural Networks (CNN) as standalone associated with normal or malicious activity. With sufficient
architectures for intrusion detection. LSTM captures training on labeled datasets, CNNs can learn to distinguish
temporal patterns in sequential data, while CNN extracts between benign and suspicious network behaviors, making
spatial features, offering distinct and complementary them valuable for both signature-based detection (identi-
approaches. fying known attack patterns) and anomaly-based detection
• Comprehensive Ablation Study: A detailed evaluation (spotting unusual behaviors that deviate from established
of hyperparameters is conducted, including the effects baselines).
of different loss functions (Sparse Categorical Crossen-
tropy and Categorical Crossentropy) and optimizers C. LONG SHORT-TERM MEMORY (LSTM)
(ADAM and SGD). This study provides critical insights Long Short-Term Memory (LSTM) networks are a type of
into configurations that optimize performance for both Recurrent Neural Network (RNN) [34] designed to process
LSTM and CNN models. sequential data and capture temporal dependencies. Unlike
• Incorporation of Explainable AI (XAI) via LIME: traditional RNNs, LSTMs utilize memory cells and gating
The integration of LIME ensures transparency in the mechanisms (input, forget, and output gates) to retain or

VOLUME 13, 2025 114981

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

discard information selectively. This structure allows LSTMs alert on previously seen threats, such as specific malware
to effectively model patterns over extended sequences, or attack types.
addressing the limitations of vanishing gradients in standard • Policy Violation Detection: NIDS can detect when
RNNs. internal users attempt to access unauthorized data
In the context of Network Intrusion Detection Systems or make configuration changes that violate network
(NIDS), LSTMs excel at analyzing network traffic as policies.
sequential data, identifying temporal relationships that may • Sensitive Data Protection: By inspecting packet pay-
signify malicious activities. This makes them particularly loads, NIDS can detect attempts to transfer sensitive
effective for detecting evolving or time-dependent attack data, such as personally identifiable information (PII),
patterns, such as slow brute-force or distributed attacks. across the network.
By leveraging their ability to model long-term dependencies, • Logging and Forensics: NIDS logs all suspicious events,
LSTMs provide robust support for anomaly-based intrusion which can be used in forensic analysis to understand
detection and complement the spatial feature extraction the attack vector, scope, and impact. This data aids
capabilities of CNNs. in investigating incidents and strengthening future
defenses.
• Assisting with Threat Containment: Once a threat is
D. GENERATIVE ADVERSARIAL NETWORK (GAN)
detected, NIDS works alongside firewalls and other
A Generative Adversarial Network (GAN) is a variation of security tools to help isolate affected network segments,
deep learning. A GAN consists of two neural networks: one containing the attack before it spreads.
for generation and another for discrimination. Training is a • SIEM Integration: NIDS can send alerts and logs to a
game-like process where a generator generates new instances Security Information and Event Management (SIEM)
that are similar to the training data, and a discriminator system, where data from multiple security tools is
assesses these instances for being real-meaning from the aggregated and analyzed.
actual dataset-or fake-created by the generator. In this • Firewall and IPS Collaboration: NIDS can work in
adversarial process, both the networks start improving over tandem with firewalls and Intrusion Prevention Systems
a period of time, whereby the generator will provide most (IPS) to block traffic or quarantine infected devices,
realistic data and a discriminator to correctly identify fake providing a layered security approach.
data.
Real-world NIDS often struggle with a lack of diverse F. POLYMORPHIC MALWARE
labeled attack data for training. GANs can be used to Polymorphic malware represents a sophisticated class of
generate synthetic examples of various attack types, which malicious software that dynamically alters its code to evade
can enrich the dataset and improve the model’s ability to detection by conventional security mechanisms, particu-
recognize unusual patterns [25]. This is especially helpful larly signature-based antivirus systems. This transformation
for rare but critical attack types that are underrepresented in occurs through various techniques such as code mutation,
training data. GANs can simulate various types of attacks or encryption, and obfuscation, where the malware modifies its
suspicious activities, which can be used to rigorously test and structure each time it replicates or propagates, thus preventing
validate NIDS. By exposing the system to a wide range of the recognition of its signature. The primary challenge in
synthetic attack scenarios, security researchers can evaluate combating polymorphic malware lies in its ability to bypass
and improve the robustness of detection mechanisms. traditional detection methods, as the changing code often
does not match known patterns. As a result, it requires
E. APPLICATION OF NIDS IN NETWORK SECURITY advanced detection approaches, including heuristic analysis
NIDS are vital components in network security, acting and behavioral monitoring, to identify and mitigate its
as early warning systems that monitor network traffic to impact effectively. This capability significantly enhances
detect malicious activity, policy violations, and suspicious its persistence and spread, posing a substantial threat to
behaviors [33]. Here,s an overview of how NIDS are applied cybersecurity infrastructures.
in network security:
III. RELATED WORK
• Traffic Monitoring: NIDS continuously monitors net- Many research efforts have investigated the use of both
work traffic, examining data packets and protocols to traditional machine learning and deep learning methods
identify unusual patterns or known attack signatures. in developing network intrusion detection systems (NIDS).
• Anomaly Detection: Using behavior-based models, These methods commonly rely on algorithms like decision
NIDS detects deviations from typical network behavior, trees, support vector machines (SVM), k-nearest neighbors
such as unexpected high volumes of traffic or unautho- (KNN), as well as deep learning models like DNNs, CNNs,
rized access attempts. and LSTMs to analyze network traffic and identify potential
• Signature-Based Detection: By matching traffic against threats. While conventional machine learning techniques are
known threat signatures, NIDS can quickly identify and generally effective at recognizing known attack patterns,

114982 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

they often struggle to detect new or evolving threats. This advanced model uses the adaptability of zero-shot
In contrast, deep learning models can autonomously capture learning alongside the computational strengths of quantum
intricate patterns from raw data, especially when working systems, minimizing the need for extensive prior knowledge
with high-dimensional data and revealing hidden patterns. about phishing URLs. The model employs quantum neural
However, deep learning approaches often demand substantial networks to map URL data into quantum spaces, utilizing
computational power and large, labeled datasets for optimal quantum layers in Q-nodes that produce fast and efficient
performance. gradients to optimize network performance.
To address these challenges, Benaddi et al. [18] made Desai and Venkatesh [23] introduced a Robust Net-
a notable contribution by showcasing the efficacy of Deep work Intrusion Detection System (RNIDS) that integrates
Reinforcement Learning (DRL) in identifying abnormal net- Convolutional Neural Networks (CNNs) with a K-Nearest
work activities, highlighting its potential to bolster network Neighbors (KNN) mechanism to improve detection accuracy.
security by tackling key issues like threat identification in The RNIDS first uses CNN to classify known attack types
complex, dynamic network settings. Further extending the and then applies KNN to identify anomalies in new traffic,
work, He et al. [19] introduced a DRL-based NIDS known as achieving high accuracy in distinguishing malicious traffic
the Transferable and Adaptable Network Intrusion Detection from benign. Their results indicate that the CNN-based model
System (TA-NIDS). Their innovative approach improved the achieves a classification accuracy of 98.3% while utilizing
system’s adaptability and resilience by leveraging small-scale only 70,252 training parameters, offering a resource-efficient
datasets to create diverse interaction scenarios, enabling it solution. However, the system may face difficulties detecting
to focus on outliers and strengthen detection performance highly sophisticated or adaptive attacks, as it relies on a
without needing extensive labeled data. This system exhibited predefined set of attack types for training.
high detection accuracy across various datasets, proving its Yan et al. [24] present a few-shot learning model for
ability to transfer learned patterns and sustain effective detec- intrusion detection in IoT systems, which leverages three
tion when deployed in new environments. Such adaptability key components: data augmentation, type conversion, and
is essential for NIDS, given the constant evolution of network image categorization to improve detection accuracy. This
traffic patterns and attack techniques, which demands models model is specifically designed to address the challenges
capable of generalizing to unfamiliar conditions. of detecting infrequent and abrupt network attacks in IoT
In another research, Al-Fawa’reh et al. [20] introduced environments, where labeled data is often sparse. Tested
MalBoT-DRL, the first botnet detection model that dynam- on the CICIDS2018 and N-BaIoT datasets, the model
ically adapts to changing malware patterns using DRL. demonstrated notable improvements over baseline accuracy,
The model’s performance was tested during both early and precision, recall, and F1-Score metrics. However, the model’s
later detection stages, achieving impressive accuracy rates of reliance on data augmentation and type conversion could
99.80% and 99.40% on the MedBIoT and N-BaIoT datasets, impact its adaptability when encountering new or highly
respectively. However, MalBoT-DRL encounters challenges dynamic attack patterns, as diverse IoT device behaviors
when detecting stealthier malware, such as Bashlite, remains may diminish the effectiveness of preset augmentation
vulnerable to adversarial attacks, and experiences higher methods.
latency with larger datasets. Despite these limitations, the In the realm of Software Defined Networking (SDN),
model consistently demonstrates training efficiency. Lotfi et al. [52] have focused on using machine learn-
Ma and Shi [21] presented a novel anomaly detection ing and deep learning for intrusion detection. Techniques
framework for IDS by integrating reinforcement learn- like autoencoders and hybrid models, such as combining
ing with class-imbalance techniques, enhancing detection autoencoders with Random Forest classifiers, have achieved
accuracy. This method incorporates the Synthetic Minority high accuracy. Entropy-based methods are also effective,
Over-sampling Technique (SMOTE) to address dataset particularly for detecting DDoS attacks. The DAERF model,
imbalances, thereby improving RL agent performance. Test- which combines autoencoders and Random Forests, achieved
ing on the NSL-KDD dataset demonstrated that this model over 98% accuracy in detecting intrusions. While these
outperformed the AE-RL model, achieving an accuracy of methods show promise, challenges like computational over-
over 82% and an F1 score above 0.824. One limitation, head and real-time adaptability remain. In another work,
however, is the reliance on the NSL-KDD dataset, which the authors [53] propose a hybrid intrusion detection model
does not fully capture real-world variability. Validating the for software-defined networks (SDNs) using convolutional
model across multiple datasets could better demonstrate its neural networks (CNN) and a novel regularization technique
robustness for real-world applications. called SD-Reg. The SD-Reg method reduces overfitting by
Recent studies also explore the combination of quantum considering the standard deviation of the weight matrix,
computing with machine learning for network security. leading to improved detection performance. The model
For instance, the authors in [22] propose ‘‘Zérosdetect,’’ achieves high accuracy, with 99.28% for binary classification
an innovative approach that combines quantum computing and 98.92% for multiclass classification on the InSDN
with zero-shot learning to enhance phishing URL detection. dataset. The results demonstrate the model’s effectiveness in

VOLUME 13, 2025 114983

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

detecting both known and unseen attacks while using fewer framework to develop self-evolving IDS in SDN environ-
features for lightweight implementation. ments. The findings show that Fed-Evolver outperforms
Addressing these limitations, Ayantayo et al. [27] proposed traditional ML-based IDS models, achieving high accuracy
advanced deep learning architectures to enhance NIDS. and adaptability across six datasets, even with just 1% labeled
Their study proposed early-fusion, late-fusion, and ensem- data.
ble models that integrate feature fusion mechanisms to A comprehensive review conducted by [13] highlights
improve multi-class classification performance, especially the growing integration of Generative Adversarial Networks
for imbalanced datasets. Using the UNSW-NB15 and NSL- (GANs) in intrusion detection systems. In their research,
KDD datasets, the late-ensemble model achieved the highest [14] applied GANs to generate synthetic data, leveraging
accuracy, with 76.8% on the UNSW-NB15 test set and DNN, CNN, and LSTM models for classification, achieving
86.81% on the NSL-KDD test set. The late-fusion and superior performance on the UNSW-NB15 dataset. In another
ensemble models exhibited robust performance, making study, [15] proposed a projection-based approach to generate
them promising solutions for addressing modern cyber adversarial attacks using a traffic-space GAN to approximate
threats. the distribution between malicious and benign traffic patterns.
In another work, Ashiku and Dagli [28] highlighted the Recent studies consistently highlight the role of DNNs
potential of Deep Neural Networks (DNNs) in creating in classification tasks, further validating their utility in
flexible IDSs with advanced learning capabilities to identify NIDS [16], [17].
malicious behaviors and mitigate security risks. Using the Despite extensive advancements in NIDS, several chal-
UNSW-NB15 dataset, the authors showcase the effectiveness lenges remain unaddressed in the existing literature. While
of their deep learning model in classifying network intrusions traditional ML techniques and DL models like CNNs,
and reducing system compromise risks. However, the paper LSTMs, and GANs have demonstrated significant promise,
does not address the challenges of real-time deployment, such many studies face limitations related to dataset imbal-
as computational overhead and latency, which are critical for ance, lack of interpretability, and scalability to real-world
large-scale network environments. scenarios. GANs have been effectively used for data aug-
The growing focus on deep learning-based Intrusion mentation to address class imbalances, but their integration
Detection Systems (IDS) was also discussed in a review with classification models often lacks thorough evaluation
by [29], which highlights the ability of deep learning for high-dimensional multiclass problems. Moreover, few
models to detect sophisticated and evolving attacks. The studies incorporate explainability techniques, such as LIME,
study critically evaluated various deep learning techniques to interpret the model’s predictions and ensure trustworthi-
using performance metrics such as accuracy, precision, ness in critical applications. Here below Table: 1, is the
recall, F1 score, false alarm rate, and detection rate. It also summary of the Literature Review on IDS.
explored challenges in network security, including privacy In this study, we address the gaps in intrusion detection
concerns, and discussed potential solutions to improve IDS by presenting a comprehensive framework for multiclass
effectiveness in diverse network environments. classification. Building on our previous work [54], where we
To address class imbalance, authors [30] proposed a tackled Trojan detection in network traffic using a hybrid
TCN intrusion detection method using a multi-scale residual CNN and BiLSTM approach, we achieved 99% accuracy
network with a global and local attention mechanism by leveraging CNNs for spatial dependencies and BiLSTMs
(MSRNet-GLAM) and an improved focus loss function (IFL) for sequential patterns. Here, we extend our research by
to enhance feature extraction. This method achieved high employing GAN-based imputation to balance the dataset,
performance on a simulated TCN intrusion scenario with effectively addressing class imbalance. This is followed by
99.51% accuracy, 98.98% precision, 99.54% recall, and applying CNN and LSTM models, which deliver exceptional
99.26% F1 score, demonstrating its effectiveness in detecting accuracy. Additionally, we incorporate LIME to enhance the
minority class and stealthy intrusions. interpretability of our model, providing clear insights into
The study [31] explored the use of optimized Multi-layer how it classifies various intrusion types. Our framework not
Perceptron (MLP) neural networks for anomaly-based intru- only achieves high detection accuracy but also emphasizes
sion detection, employing Gray Wolf Optimization (GWO) transparency and robustness, making it ideal for deploy-
to refine connection parameters. Findings demonstrate that ment in real-world networks facing dynamic and evolving
the GWOMLP-IDS enhances performance metrics, reducing threats.
error rates and improving detection accuracy in simulations.
However, the methodology requires substantial computa- IV. METHODOLOGY
tional resources and extensive labeled datasets, posing This is the proposed methodology section. This study use
challenges in scalability and deployment. a Convolutional Neural Network (CNN) as the primary
Duy et al. [32] used a novel methodology, Fed-Evolver, classifier to establish a robust machine learning framework
integrating Generative Adversarial Networks (GANs), for intrusion detection. A common characteristic of intrusion
Autoencoders (AEs), and a semi-supervised adversarial detection datasets is class imbalance, wherein hostile activity
Autoencoder (SSAAE) within a Federated Learning (FL) is significantly outnumbered by benign traffic. This study

114984 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

TABLE 1. Summary of literature review on machine learning or deep learning-based intrusion detection systems.

seeks to solve a primary concern. Imbalances may lead strategy. To ascertain the model’s capability to accurately
to the emergence of models biassed towards the domi- identify various sorts of network traffic, it was subse-
nant class, resulting in lower detection rates for minority quently trained and assessed utilising a diverse array of
classes, particularly those representing various forms of indicators. However, we apply Label Encoding to convert
cyberattacks. characteristics that comprise category values into match-
The issue was addressed by utilising a Generative ing numeric values and normalizing all the values using
Adversarial Network (GAN) to provide synthetic samples Min-Max normalization prior to this data balance. Here
for minority classes, so effectively balancing the dataset. below is the detailed description of each of these sections
CNN enhanced its learning from both benign and hos- and Figure: 2, shows the proposed architecture of our
tile circumstances by the application of this balancing study.

VOLUME 13, 2025 114985

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

FIGURE 2. The proposed architecture, showing the complete workflow from data preprocessing and GAN-based balancing to model training and
evaluation.

A. DATA DESCRIPTION C. NORMALIZATION

The dataset utilized in this study, NF-CSE-CIC-IDS2018 In this study, we employed a systematic Min-Max normal-
[42], comprises a substantial collection of network traffic ization technique to equalize the range of values across
data, encompassing both benign and attack instances all features in the dataset. Which ensures that each feature
across various intrusion types. The dataset initially contributed equally to the model’s training [38]. Thus,
displayed a considerable class imbalance, comprising we reduced the possibilities of feature dominance, where
7,373,198 benign instances contrasted with a markedly attributes with greater numeric scales would have dispropor-
lower number of instances for different attack types. tionately influenced model learning.
These included DDoS attacks-LOIC-HTTP with 378,199 To achieve this, we applied the Min-Max normalization
instances, FTP-BruteForce with 193,360 instances, and formula:
DoS attacks-Hulk with 108,136 instances, among oth- x − xmin
ers. Class-wise distribution of the dataset is shown is xnorm = (2)
xmax − xmin
Table: 2.
where:
B. LABEL ENCODING • x represents the original feature value,
• xmin and xmax are the minimum and maximum values of
In our study, we utilized label encoding to transform
categorical network traffic data into numerical data. It assigns the feature across the dataset.
a distinct numerical data to each category, facilitating the During this procedure, each attribute was normalized to
incorporation of categorical data into the model. This strategy the interval [0, 1]. This approach enabled us to uphold
does not imply any hierarchy among the categories. This consistency across feature scales, which was crucial for
method guarantees that all data types are represented in a the convergence and stability of our deep learning models,
manner comprehensible to the model [40]. We utilized label especially the CNNs employed for intrusion detection.
encoding on categorical columns in our dataset, including By standardizing the data prior to addressing class imbalance
IPV4_SRC_ADDR and IPV4_DST_ADDR, which denote with our GAN, we facilitated the generation of precise and
source and destination IP addresses. A LabelEncoder was balanced synthetic samples for underrepresented classes.
employed for each column to allocate a distinct integer
to every unique category. This change may be expressed D. IMPUTING IMBALANCE DATASET USING GAN
as: Imbalanced datasets, which include significant underrepre-
sentation of certain classes, provide a difficulty in machine
encoded_value(xi ) = LabelEncoder(xi ) (1) learning and data-driven applications. In classification tasks,
models often exhibit a bias towards majority classes, leading
where:
to subpar performance on minority classes. GANs can
• xi is the original categorical value, be employed to produce synthetic samples for minority
• encoded_value(xi ) is the corresponding integer assigned classes, therefore balancing the dataset and enhancing model
by the encoder. applicability.
This method ensured that categorical data was represented GANs comprise two neural networks: a Generator G
in a way that the model could easily interpret. and a Discriminator D, which are concurrently trained by

114986 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

TABLE 2. Class-wise distribution of dataset for training, validation, and test sets.

FIGURE 3. The architecture of the generative adversarial network (GAN), highlighting the interaction between the generator and discriminator to create
synthetic data.

an adversarial mechanism. The generator creates synthetic Here in this equation:

samples that strive to replicate genuine data, while the
 
• Ex∼pdata log D(x) represents the discriminator’s ability
discriminator assesses the authenticity of each sample as to classify
 real samples as real.
either real or fake. This rivalry compels the generator to create • Ez∼pz (z) log(1 − D(G(z))) represents the discrimina-
authentic synthetic data suitable for augmenting minority tor’s ability to classify generated samples as fake.
classes. Figure: 3 illustrates the architecture of Generative The Generator aims to minimize log(1 − D(G(z))) or,
Adversarial Networks (GANs) and provides a detailed equivalently, maximize log D(G(z)), thus improving its
description of each component involved in generating new ability to produce realistic samples that can ‘‘fool’’ the
data samples to address the dataset imbalance described Discriminator into classifying them as real. This adversarial
below. process drives both networks to improve over time, resulting
in high-quality synthetic data that can effectively balance the
1) GANs FRAMEWORK dataset.
The GANs framework is relies on a minimax game between
the Generator and the Discriminator [39]. Let pdata (x) 2) PROCESS OF THE GENERATOR
represent the distribution of real data, and pz (z) denotes of Step 1: Input Noise Vector
the noise vector z, generally sampled from a standard normal The generator takes in a noise vector z, which is sampled
distribution N (0, 1). The Generator G transforms the noise from a standard normal distribution z ∼ N (0, 1). In our
vector z ∼ pz (z) into a synthetic data sample or fake samples implementation, the dimensionality of z is determined by the
xfake = G(z). The Discriminator D receives both real samples number of features in the class data being augmented. This
xreal ∼ pdata (x) and fake samples xfake = G(z), and outputs noise vector provides the generator with a random starting
a probability D(x) indicating its confidence that x is a real point to create synthetic samples that resemble the target class
sample. data.
So, the objective of the GANs is formulated as a minimax Step 2: Transformation Through Neural Network
optimization problem, which denotes as the following Layers
equation: The generator is a multi-layer neural network that applies

min max V (D, G) = Ex∼pdata log D(x)
 several transformations to z to generate realistic data points.
G D
  Each layer of the generator gradually refines the random
+ Ez∼pz (z) log(1 − D(G(z))) (3) noise into structured data through:

VOLUME 13, 2025 114987

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

• Dense layers that apply linear transformations (weights • Activation functions, specifically Leaky ReLU, which
and biases), allows for better gradient flow and helps to avoid
• Activation functions, specifically ReLU for hidden ‘‘dying’’ neurons,
layers to introduce non-linearity, • Dropout layers are used to prevent overfitting, making
• Batch normalization to stabilize the learning process and the discriminator more robust in distinguishing real and
improve convergence. fake samples [41].
Step 3: Output Synthetic Sample 3: Output Real or Fake Classification
The generator produces synthetic data samples by transform- The discriminator’s final layer outputs a single probability
ing input noise vectors through its neural network layers. D(x) through a sigmoid activation function, with values rang-
Specifically, the generator maps a noise vector z to a synthetic ing between 0 and 1. This output indicates the discriminator’s
sample xfake using the function G(z): confidence in the sample’s authenticity:
• D(x) ≈ 1: The discriminator is confident that x is a real
xfake = G(z) (4)
sample.
In our implementation, z is sampled from a standard • D(x) ≈ 0: The discriminator believes that x is a synthetic
normal distribution: sample generated by G.
z ∼ N (0, 1) (5)
4) TRAINING PROCESS: ADVERSARIAL LEARNING
The generator network consists of multiple layers that The training of our GAN involves an adversarial learning
sequentially transform z into xfake . Each hidden layer applies process, where the generator and discriminator iteratively
a linear transformation followed by a ReLU activation improve based on each other’s performance. The following
function: steps outline the training process implemented in our code.
Training the Discriminator
 
h(l) = ReLU W(l) h(l−1) + b(l) (6)
• Sample Real Data: A minibatch of real samples
(i)
where: {xreal }m
i=1 is randomly selected from the class data.
• h(0) = z • Generate Fake Data: Noise vectors {z(i) }m i=1 are
• W(l) and b(l) are the weights and biases of layer l sampled from a normal distribution, and the generator
(i)
• ReLU(·) is the Rectified Linear Unit activation function produces synthetic samples xfake = G(z(i) ).
The final output layer applies a linear transformation • Compute Discriminator Loss: The discriminator loss
followed by a hyperbolic tangent activation function (tanh) LD is calculated as:
to ensure the output values are within the desired range: m
1 X (i) (i)

  LD = − log D(xreal ) + log(1 − D(xfake )) (8)
xfake = tanh W(L) h(L−1) + b(L) (7) m
i=1

Here, L denotes the final layer of the generator. This loss encourages the discriminator to maximize
By applying these transformations, the generator outputs D(xreal ) for real samples and minimize D(xfake ) for fake
synthetic samples xfake that have the same dimensionality samples.
as the real data and resemble the distribution of the specific • Update Discriminator: The discriminator’s weights are
attack type in the dataset. updated using backpropagation to minimize LD .
Training the Generator
3) PROCESS OF THE DISCRIMINATOR • Generate Fake Data: Another minibatch of noise
The discriminator evaluates both real samples from the vectors {z(i) }m
i=1 is sampled, and the generator creates
(i)
training dataset and synthetic samples generated by the new synthetic samples xfake = G(z(i) ).
generator to learn to distinguish between real and fake data. • Compute Generator Loss: The generator’s objective
1: Input Data Sample (Real or Fake) is to ‘‘fool’’ the discriminator. The generator loss LG is
The discriminator takes a data sample x as input, which defined as:
could either be a real sample xreal from the training data or 1X
m
a fake sample xfake = G(z) generated by the generator. The LG = − log D(G(z(i) )) (9)
m
discriminator does not ‘‘know’’ whether a sample is real or i=1
fake at the time of evaluation; instead, it learns to differentiate Minimizing LG encourages the generator to produce
between the two through training. samples that the discriminator classifies as real (i.e.,
2: Transformation Through Neural Network Layers D(G(z)) ≈ 1).
The discriminator is a multi-layer neural network that • Update Generator: The generator’s weights are
processes the input x through several transformations, similar updated using backpropagation to minimize LG .
to the generator but with a different architecture: Iterative Training Process The generator and discrim-
• Dense layers that perform linear transformations inator are trained in alternating steps, iterating over the
(weights and biases), following:

114988 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

Algorithm 1 Balancing Imbalanced Datasets Using Genera-

tive Adversarial Networks (GANs)
1: Initialize Generator G and Discriminator D neural
networks
2: Define noise vector distribution pz (z) ∼ N (0, 1)
3: Set number of training iterations T
4: Set minibatch size m
5: for t = 1 to T do
(i)
6: Sample a minibatch of real data samples {xreal }m i=1
from pdata (x)
7: Sample a minibatch of noise vectors {z(i) }m i=1 from
pz (z)
(i)
8: Generate synthetic samples {xfake = G(z(i) )}mi=1
9: Compute Discriminator loss:
m
1 X  FIGURE 4. A circular plot comparing the dataset’s class distribution
(i) (i)
LD = − log D(xreal ) + log(1 − D(xfake )) before and after applying GANs, visualizing the transition to a balanced
m state.
i=1
TABLE 3. Jensen-Shannon divergence values of the features for network
10: Update Discriminator parameters by minimizing LD intrusion detection.
via backpropagation
11: Sample a new minibatch of noise vectors {z(i) }m
i=1 from
pz (z)
(i)
12: Generate synthetic samples {xfake = G(z(i) )}m
i=1
13: Compute Generator loss:
m
1X
LG = − log D(G(z(i) ))
m
i=1

14: Update Generator parameters by minimizing LG via

backpropagation
15: Alternate between updating D and G in each iteration
16: end for
17: Sample noise vectors {zsynth } from pz (z)
18: Generate synthetic minority class samples {xsynth = they differ. It is based on Kullback-Leibler (KL) divergence
G(zsynth )} but is symmetric and always gives a finite result, making
19: Augment the original dataset with {xsynth } to achieve it easier to interpret. JSD values range from 0 to 1, where
balanced classes 0 means the distributions are identical and higher values
mean greater differences. A lower JSD value suggests that the
GAN has done a good job in generating synthetic data that
• Update the discriminator with a mix of real and closely resembles real data, making it useful for balancing
generated samples. the dataset. By analyzing JSD values, we can ensure that
• Update the generator to improve its ability to produce the generated data preserves the key characteristics of the
realistic samples, minimizing LG . original dataset while helping to improve model performance
Algorithm: 1, outlines the entire procedure for producing in detecting network intrusions.
new data samples utilizing GANs to balance our imbalanced
dataset. E. APPLIED CNN AND LSTM ALGORITHM
Here in Figure: 4, it is evident that before balancing the Here, we present a comprehensive overview of the architec-
dataset, the number of instances across classes ranged from tures employed in our research. CNN and an LSTM) network.
22,825 to 7,373,198. However, after implementing the GAN, In Table: 4, CNN Model Architecture outlines a structured
all classes were uniformly balanced with 7,373,198 instances sequence of layers, beginning with convolutional layers
each. (Conv1D) designed to extract local patterns from the
The Table: 3 presents the Jensen-Shannon Divergence input data. This is followed by batch normalization
(JSD) values for different features used in network intrusion layers (BatchNormalization) that enhance the stability
detection. JSD helps measure how similar the distributions of the model and speed up the training. The pooling
of real and GAN-generated synthetic data are. JSD is a way layers (MaxPooling1D) progressively reduce spatial dimen-
to compare two probability distributions and see how much sions, emphasizing essential features while maintaining

VOLUME 13, 2025 114989

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

TABLE 4. A layer-by-layer summary of the CNN architecture, showing the V. PERFORMANCE ANALYSIS
output shape and parameter count for each component.
This is the section for results analysis. The result has
been evaluated utilizing many metrics, including Confusion
Matrix, Accuracy, Precision, Recall, and F-1 Score. The
AUC Score and ROC Curves have also been analyzed. The
following is a comprehensive description of each section.
• Confusion Matrix: The confusion matrix illustrates the
model’s performance by presenting counts of True Pos-
itives (TP), True Negatives (TN), False Positives (FP),
and False Negatives (FN). This enables us to identify
areas where the model accurately predicts and where
it erroneously categorizes network traffic as benign
or malicious. This metric is valuable for identifying
the model’s unique faults, facilitating adjustments to
minimize inaccuracies.
A confusion matrix can be represented as follows:
 
TABLE 5. A layer-by-layer summary of the LSTM architecture, detailing TP FP
the output shape and parameter count for each component.
FN TN
where:
– True Positives (TP): Correctly predicted malicious
traffic,
– False Positives (FP): Benign traffic incorrectly
predicted as malicious,
– False Negatives (FN): Malicious traffic incorrectly
predicted as benign,
– True Negatives (TN): Correctly predicted benign
traffic.
• Accuracy: Accuracy quantifies the model’s overall
correctness by determining the ratio of correct predic-
tions to the total predictions made. Although accuracy
provides a broad measure of performance, it may
be insufficient for imbalanced datasets, where a high
computational efficiency. Fully connected layers (Dense) accuracy rate can coexist with subpar performance
capture higher-level abstractions, with dropout layers on underrepresented classes. In our study, accuracy is
(Dropout) strategically placed to mitigate overfitting. The calculated as:
output shapes and parameter counts for each layer illustrate TP + TN
the complexity of the model, showcasing its ability to learn Accuracy = (10)
TP + TN + FP + FN
effectively from the data.
• Precision: Precision measures the ratio of true positive
In Table: 5, LSTM Model Architecture presents a network
predictions to the total positive predictions made by the
tailored for sequential data, where temporal dependencies
model. This statistic is particularly valuable in scenarios
are crucial. The architecture begins with LSTM layers
where the expense of false positives is significant,
that capture long-range dependencies, followed by batch
as it indicates the model’s proficiency in reducing
normalization and pooling layers to stabilize learning and
the misclassification of benign traffic as malicious.
reduce dimensionality. Similar to the CNN model, the LSTM
Precision is defined as:
model integrates fully connected layers and dropout layers
TP
to refine the feature representation and prevent overfitting. Precision = (11)
The inclusion of multiple LSTM layers, along with detailed TP + FP
output shapes and parameter counts, highlights the model’s • Recall: Recall, assesses the model’s capacity to accu-
capacity to handle complex time series data and its potential rately detect real positive instances among all actual
for high-performance prediction tasks. positive instances. In network intrusion detection, recall
Together, these two models CNN and LSTM, demonstrate is crucial as it indicates the model’s proficiency in
complementary approaches, each carefully designed to detecting possible threats, despite the possibility of
leverage different aspects of the data, be it spatial or temporal, producing false positives. Recall is calculated as:
while ensuring robustness and generalization across various TP
learning tasks. Recall = (12)
TP + FN
114990 VOLUME 13, 2025
M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

• F-1 Score: The F1 Score integrates precision and recall TABLE 6. A high-level comparison of the overall Accuracy, Precision,
Recall, and F1-Score for the final LSTM and CNN models.
into a unified statistic, offering a balanced assessment
in the presence of class imbalance within the dataset.
It represents the harmonic mean of precision and recall,
thereby providing a more thorough assessment of the
model’s performance in relation to both measures. The
F1 Score is defined as:
such as ‘‘Benign,’’ ‘‘SSH-Bruteforce,’’ and ‘‘DoS attacks-
Precision × Recall
F1-Score = 2 × (13) SlowHTTPTest,’’ with perfect scores (1.00) in precision,
Precision + Recall recall, and F1-score. For challenging classes, such as ‘‘DoS
A. CONFUSION MATRIX attackes-Slowloris,’’ LSTM outperformed CNN with an F1-
The confusion matrices for the LSTM and CNN models score of 0.98 compared to 0.92. Similarly, in the case of
illustrate their performance in classifying various types ‘‘FTP-BruteForce,’’ the LSTM model achieved a higher recall
of network traffic, including benign and attack cate- (1.00) and precision (0.98) compared to CNN’s recall and
gories. In Figure: 5, we can see that the LSTM model precision scores of 1.00 and 0.91, respectively.
demonstrates near-perfect classification accuracy across all The precision and recall for classes such as ‘‘DDoS attacks-
categories, achieving 100.00% accuracy for Infiltration, LOIC-HTTP’’ also reflected the robustness of the LSTM
FTP-Bruteforce, DoS attacks-SlowHTTPTest, and Benign model, scoring 0.97 in F1 compared to CNN’s 0.97. These
traffic. It also achieves high accuracy for DoS attacks- per-class metrics emphasize the LSTM model’s consistent
GoldenEye (98.12%), DoS attacks-Slowloris (99.80%), ability to maintain high detection rates across diverse attack
SSH-Bruteforce (99.62%), DoS attacks-Hulk (99.96%), and types, while the CNN model displayed slight performance
DDoS attacks-LOIC-HTTP (99.98%), with minimal mis- drops in precision for certain categories.
classifications. In contrast, the CNN model, while also per- Overall, the LSTM model proved to be a more reliable
forming robustly, exhibits slightly lower accuracy for certain choice for intrusion detection, excelling in handling both
categories. It achieves 100.00% accuracy for Infiltration, DoS benign and malicious traffic with high accuracy, precision,
attacks-GoldenEye, FTP-Bruteforce, DDoS attacks-LOIC- recall, and F1-score. Meanwhile, the CNN model, despite
HTTP, and Benign traffic but struggles with some attack its slight underperformance in comparison, remains a viable
types. For instance, the CNN achieves 87.55% accuracy alternative with competitive metrics for most classes.
for DoS attacks-Slowloris, with 6.45% misclassified as
GoldenEye and 5.63% as other categories, and 89.13% for C. VALIDATION CURVES
DoS attacks-Hulk, with 9.99% misclassified as Slowloris. The validation and training curves for the LSTM and CNN
Overall, the LSTM model outperforms the CNN model in models, as illustrated in Figure: 6, provide insights into
handling complex attack types, offering more consistent and the learning behavior and convergence of the models over
reliable classification, particularly for challenging cases such 50 epochs. The accuracy and loss plots depict the models’
as Slowloris and Hulk attacks. progression during training and their ability to generalize to
unseen data.
B. ACCURACY, PRECISION, RECALL AND F1-SCORE Figures: 6a and 6b show the LSTM model’s validation and
The evaluation metrics, including accuracy, precision, recall, training accuracy and loss curves, respectively. The accuracy
and F1-score, provide comprehensive insights into the curve indicates rapid improvement during the initial epochs,
performance of the models. Table 6 compares the overall stabilizing at a high accuracy of approximately 99% for both
performance of the CNN and LSTM models, while Table 7 training and validation data. This convergence demonstrates
highlights the per-class metrics, showcasing the nuanced the LSTM’s capacity to effectively learn patterns in the
capabilities of these models in handling diverse attack types dataset. The loss curves exhibit a consistent downward trend,
and benign traffic. with both training and validation losses steadily decreasing
The LSTM model demonstrated superior performance and reaching minimal values by the end of the training. The
with an overall accuracy of 99.67%, surpassing the CNN small gap between training and validation curves reflects
model’s 97.45%. This superiority extends to other metrics, minimal overfitting, confirming the LSTM model’s robust
with LSTM achieving a precision of 99.34%, recall of generalization capabilities.
99.65%, and an F1-score of 99.45%. In comparison, the Figures: 6c and 6d, present the CNN model’s validation
CNN model attained a precision of 97.87%, recall of 98.12%, and training accuracy and loss curves, respectively. The
and an F1-score of 98.02%. These results indicate that accuracy curves reveal a similar trend of rapid improvement
while CNN performed well, the LSTM model exhibited in the initial epochs, with final accuracy values stabilizing
higher reliability in accurately classifying instances across all near 97% for both training and validation data. The training
categories. and validation loss curves display a consistent decline,
Examining the per-class metrics in Table 7, both demonstrating the model’s effective optimization during
models achieved excellent performance for most classes, training. However, a slightly larger gap between the training

VOLUME 13, 2025 114991

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

FIGURE 5. Confusion matrix for two different model architectures.

and validation accuracy and loss curves compared to the the CNN model, despite slightly higher overfitting tenden-
LSTM model suggests that the CNN model may be slightly cies, still performs effectively.
more prone to overfitting, though the overall generalization
remains satisfactory. D. ABLATION STUDY
In summary, the validation curves confirm the superior To evaluate the impact of different hyperparameters on
learning performance and generalization of the LSTM the performance of the proposed NIDs, we conducted an
model compared to the CNN model, with both models ablation study focusing on two loss functions—Sparse Cat-
achieving high accuracy and low loss. The LSTM’s minimal egorical Crossentropy and Categorical Crossentropy—and
performance gap between training and validation metrics two optimization algorithms—ADAM (Adaptive Moment
underscores its suitability for this classification task, while Estimation) and SGD (Stochastic Gradient Descent). The

114992 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

TABLE 7. A detailed breakdown of Precision, Recall, and F1-Score for each traffic class, comparing the performance of the CNN and LSTM models.

FIGURE 6. Training and validation accuracy and loss curves for the different LSTM and CNN models architecture.

experiments were performed separately on two model the efficacy of the ADAM optimizer in enhancing the learning
architectures, LSTM and CNN, to analyze their robustness process for LSTM models.
and effectiveness under various settings. The evaluation Similarly, for the CNN architecture, Sparse Categor-
metrics included accuracy, precision, recall, and F1-score, ical Crossentropy consistently outperformed Categorical
ensuring a comprehensive assessment. Crossentropy across all metrics. When using the ADAM
Here in Figure: 7, the results reveal that the choice of optimizer, the CNN model achieved an accuracy of 97.78%,
loss function and optimizer significantly influences model with precision, recall, and F1-scores all above 97%. While the
performance. For the LSTM architecture in Figure: 7a, the SGD optimizer also demonstrated competitive results, it fell
combination of Sparse Categorical Crossentropy and ADAM short of the performance achieved with ADAM. Notably, the
optimizer delivered the best results, achieving an accuracy accuracy with Sparse Categorical Crossentropy and SGD was
of 99.67%, with precision, recall, and F1-score exceeding 97.19%, compared to 96.04% with Categorical Crossentropy.
99%. Sparse Categorical Crossentropy also outperformed Overall, the study highlights that Sparse Categorical
Categorical Crossentropy when paired with the SGD opti- Crossentropy is a more effective loss function for both LSTM
mizer, although the overall performance with SGD was and CNN architectures in the context of NIDS. Addition-
slightly lower compared to ADAM. This trend underscores ally, the ADAM optimizer consistently outperformed SGD,

VOLUME 13, 2025 114993

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

FIGURE 7. Results from the ablation study, comparing model performance using different optimizers and loss functions for both architectures.

demonstrating its suitability for training deep learning models In Figure: 8a, the LIME explanation highlights key features
in this framework. These findings emphasize the importance influencing the classification of an Infiltration instance. Fea-
of carefully selecting hyperparameters to optimize model tures such as OUT_PKTS > −0.02, FLOW_DURATION,
performance, ensuring robust and reliable intrusion detection. and OUT_BYTES > −0.01 exhibit strong positive con-
tributions to the prediction probability. Conversely, features
E. INTERPRETABILITY AND FEATURE IMPORTANCE like PROTOCOL <= −0.32 and L7_PROTO negatively
ANALYSIS USING LIME impact the prediction, pulling the classification away from
The integration of Local Interpretable Model-Agnostic Infiltration. These insights demonstrate the model’s reliance
Explanations (LIME) into this study serves as a crucial step on specific network flow attributes, such as packet count and
toward enhancing model transparency and interpretability, protocol type, for accurate detection of infiltration.
particularly in high-stakes domains like network intrusion Similarly, Figure: 8b, illustrates the LIME explanation for
detection. DL models, despite their predictive strength, often the FTP-BruteForce class. Features such as OUT_PKTS,
function as black boxes, making it difficult for cybersecurity IPV4_SRC_ADDR, and FLOW_DURATION strongly
analysts to understand the rationale behind specific predic- contribute to the prediction of this class. Conversely,
tions. LIME addresses this challenge by providing local, attributes such as PROTOCOL and L4_DST_PORT act
instance-level explanations that reveal which features most as negative predictors, reducing the likelihood of misclassi-
significantly influence a model’s decision. fication. The positive contributions of L4_SRC_PORT >
Figure: 8, illustrates the interpretability outputs generated 0.68 and OUT_BYTES > −0.02 indicate their importance
using the framework for two selected classes: Infiltration in identifying FTP-BruteForce attacks.
(Figure: 8a) and FTP-BruteForce (Figure: 8b). The LIME The feature importance rankings derived from LIME
visualizations provide a detailed understanding of the features outputs reveal the most influential attributes for each class,
contributing to the model’s predictions for specific instances, enabling a deeper understanding of the model’s decision-
offering transparency and interpretability in the classification making process. This analysis underscores the critical role
process. of features such as source port, flow duration, and packet

114994 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

FIGURE 8. Interpretability of our LSTM model using LIME.

counts in classifying network attack types, enhancing trust dataset as ours achieved an accuracy of 97.21% and an
and reliability in the predictions made by the deep learning F1-score of 96.4%. These models lack the advanced features
models. of our framework, such as the use of GANs to balance under-
represented classes and improve detection of minority attack
F. COMPARISON ANALYSIS WITH EXISTING APPROACHES types. Other techniques, including CNN-LSTM applied to
The proposed LSTM-based Network Intrusion Detection the InSDN dataset, reported an accuracy of 96.32%, but
System (NIDS) demonstrates exceptional performance com- they lack the robustness and interpretability offered by our
pared to existing approaches, as detailed in Table: 8. system.
When evaluated on the NF-CSE-CIC-IDS2018 dataset, our Our framework not only achieves superior accuracy but
framework achieves a high detection accuracy of 99.67%, also incorporates explainable AI techniques, such as LIME,
along with precision, recall, and F1-scores of 99.34%, which provide clear insights into the model’s decision-
99.65%, and 99.45%, respectively. These results highlight making process. This feature is particularly important for
the system’s ability to effectively identify network intrusions, real-world deployment, as it allows cybersecurity teams to
even in challenging scenarios involving imbalanced datasets understand why specific traffic patterns are flagged as mali-
and diverse attack types. cious, thereby increasing trust in the system. While methods
Existing methods, such as CNN-BiLSTM models evalu- like CNN-GRU and PSO-GA with LSTM-GRU achieved
ated on the NSL-KDD dataset, showed significantly lower high accuracy (99.65% and 98.86%, respectively), they do
accuracy (83.58%) and F1-scores (85.14%). Similarly, a deep not address the need for interpretability and adaptability to
neural network (DNN)-based approach applied to the same evolving threats as effectively as our framework.

VOLUME 13, 2025 114995

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

TABLE 8. Comparison of our proposed model performance metrics with existing work which are machine learning and deep learning based approaches.

By integrating GANs for data augmentation, combining to adapt through synthetic data generation means it can
CNN and LSTM architectures for spatial and temporal prepare for new attack vectors before they’re seen in the wild.
feature extraction, and incorporating LIME for transparency, For instance, if a new type of DDoS attack emerges, the GAN
our framework establishes a new benchmark in intrusion component could generate similar attack patterns to train the
detection. detection models, creating a proactive rather than reactive
It offers a reliable, accurate, and interpretable solution security posture.
that meets the needs of modern network security environ- Small and medium-sized businesses, which often lack
ments, making it well-suited for large-scale and real-time extensive cybersecurity resources, could benefit from this
applications. solution as a managed security service. The high automation
and self-learning capabilities mean these organizations can
VI. APPLICATION OF OUR PROPOSED NIDS maintain enterprise-grade security without requiring large
First, consider enterprise network environments. Large security teams. Looking at future applications, our framework
organizations like banks, healthcare institutions, and tech- could be extended to secure emerging technologies like
nology companies handle massive amounts of sensitive 5G networks and IoT environments, where the variety and
data daily. Our framework could be deployed as an intel- volume of network traffic patterns create complex security
ligent security layer that continuously monitors network challenges. The framework’s ability to handle diverse attack
traffic in real-time. The combination of CNN and LSTM types while maintaining high accuracy makes it well-suited
models would allow it to detect both immediate threats for these evolving technological landscapes.
(through CNN’s spatial analysis) and evolving attack patterns
(through LSTM’s temporal understanding). For example, if a
VII. DEPLOYMENT STRATEGY
sophisticated attacker attempts to slowly exfiltrate customer
To ensure optimal performance and scalability of the
data over several days, the LSTM component would be
CNN-based Network Intrusion Detection System (NIDS),
particularly effective at detecting these subtle, time-based
a structured deployment strategy is essential. This section
patterns.
outlines a hypothetical deployment framework aimed at
In critical infrastructure protection, such as power grids
maximizing detection accuracy, reducing latency, and main-
or water treatment facilities, the framework’s ability to
taining adaptability for various network environments.
handle imbalanced datasets becomes crucial. These systems
rarely experience attacks, making historical attack data
A. DEPLOYMENT PHASES
scarce. Our GAN-based approach to generating synthetic
attack samples ensures the system remains vigilant even To ensure a smooth deployment, the following phases are
for rare but potentially catastrophic scenarios. The high recommended:
accuracy rates (99.67% for LSTM and 97.45% for CNN) 1) Initial Setup and Testing: In the initial phase,
would minimize false alarms while maintaining robust the system is set up in a test environment with
protection. historical network traffic data to evaluate detection
The integration of LIME for explainable AI addresses a accuracy and optimize the CNN hyperparameters.
significant practical challenge in cybersecurity operations. This phase includes model training, tuning, and
Security analysts often need to justify their actions to validation.
management or comply with regulatory requirements. When 2) Pilot Deployment: The model is deployed on a small
our system flags suspicious activity, it can provide clear, portion of the network in a controlled environment.
interpretable explanations of why certain traffic patterns This stage enables performance monitoring under
were deemed malicious. This transparency is invaluable real-world conditions and helps identify any necessary
for organizations in regulated industries like finance or adjustments to the data preprocessing or alerting
healthcare, where security decisions must be documented and mechanisms.
justified. 3) Full Deployment and Monitoring: Upon successful
Consider also the framework’s application in cloud service pilot testing, the NIDS is scaled to cover the entire
providers. These environments face constantly evolving network. Continuous monitoring is essential to ensure
threats across multiple clients’ networks. The system’s ability the system’s efficiency. This phase includes setting

114996 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

up logging systems, establishing alert thresholds, and VIII. HARDWARE CONSIDERATIONS

optimizing response times. To effectively deploy the proposed CNN-based intrusion
4) Maintenance and Model Updates: Routine mainte- detection system, updated hardware specifications suitable
nance is crucial for adapting the model to evolving for varying deployment scenarios are outlined in Table 9.
network behaviors and emerging threats. Periodic These setups cater to different levels of performance needs,
model retraining with new network traffic data is from small-scale testing to large-scale real-time network
recommended to maintain detection accuracy and environments.
reduce false positives. Processor: For basic testing and small-scale deployments,
a mid-range processor like the Intel Core i7-12700H (14
B. PERFORMANCE OPTIMIZATION cores, 20 threads) at 2.3 GHz base clock is sufficient. For
To optimize deployment performance, the following consid- high-performance or real-time applications, an advanced
erations are implemented: processor such as the AMD Ryzen 9 7950X (16 cores,
32 threads, 4.5 GHz base clock) is recommended to handle
• Load Balancing: For high-traffic networks, load bal- extensive data processing and reduce model training time.
ancers are deployed to distribute data evenly across RAM: A minimum of 16 GB RAM is recommended
processing nodes, minimizing latency and ensuring for smooth handling of training and inference processes
efficient resource utilization. on moderate datasets. For larger datasets or parallelized
• Edge Processing: In large-scale deployments, some workflows, upgrading to 32 GB or 64 GB is highly beneficial
preprocessing and initial anomaly detection are per- to prevent memory bottlenecks. Graphics: Integrated GPUs
formed at the network edge to reduce data transmission are inadequate for training CNNs efficiently. A dedicated
to the central system and to provide faster preliminary GPU such as the NVIDIA GeForce RTX 4060 (8 GB
alerts. GDDR6) is suggested for cost-effective setups. For large-
• Automatic Scaling: For cloud-based deployments, the scale, high-speed training, the NVIDIA RTX 4090 (24 GB
architecture supports auto-scaling to adjust computa- GDDR6X) provides unparalleled performance with CUDA
tional resources based on network traffic volume and cores and Tensor Core acceleration.
detection demand.
• Alert Prioritization and Incident Response Integra- IX. PERFORMANCE TRADE-OFF
tion: The NIDS integrates with incident response tools The proposed NIDS framework carefully balances competing
to prioritize alerts based on threat level. High-severity factors to achieve optimal performance in real-world scenar-
threats trigger immediate alerts, while lower-priority ios. A key trade-off involves detection accuracy and latency.
alerts are batched for regular review. By utilizing GANs to handle class imbalance and employing
CNN-LSTM architectures for enhanced intrusion detection,
C. SECURITY AND COMPLIANCE CONSIDERATIONS the system delivers high accuracy, especially for minority-
To maintain network integrity and comply with stringent class attacks. However, this improved accuracy comes at
security regulations, the deployment strategy incorporates the cost of increased computational latency, which can pose
robust measures, including encryption for data in transit challenges for real-time detection in high-speed networks.
and at rest using TLS and AES standards, ensuring that Addressing this requires careful optimization of model
sensitive information remains protected from unauthorized parameters and efficient utilization of hardware resources to
access. Regular vulnerability assessments and penetration maintain responsiveness without compromising accuracy.
testing are conducted to proactively identify weaknesses, with Another critical trade-off is between false positives and
automated scans and annual external tests simulating real- false negatives. While reducing false negatives is essential
world attacks. Role-based access control (RBAC) enforces to ensure no critical threats are missed, it often comes at the
the principle of least privilege, limiting access based on cost of a higher rate of false positives, which can overwhelm
user roles, while multi-factor authentication (MFA) adds analysts with unnecessary alerts. To address this, the system
an extra layer of security for privileged users. All access employs LIME for explainability, helping administrators
attempts, security events, and intrusion detections are logged understand why specific traffic is flagged as malicious. This
in a secure environment, with real-time monitoring tools transparency not only builds trust in the system but also
like SIEM systems analyzing events to detect anomalies allows for better fine-tuning to balance false positive and
quickly. These logs are subject to regular audits to ensure negative rates.
compliance with cybersecurity standards such as GDPR The trade-off between model complexity and resource
and NIST. Additionally, the system is equipped with auto- utilization also plays a significant role. The inclusion of
mated incident response protocols, including containment GANs for generating synthetic samples, alongside the use
measures like isolating compromised segments, to limit the of deep learning models, requires substantial computa-
spread of threats, and detailed reports are generated for tional resources, such as high-performance GPUs and large
each alert, documenting the threat and response actions memory capacities. While these resources may not be
taken. readily available in all environments, particularly in edge or

VOLUME 13, 2025 114997

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

TABLE 9. Recommended hardware specifications for deploying the intrusion detection system in various environments, from basic testing to
high-performance.

IoT deployments, techniques like efficient hyperparameter be validated, making scalability and deployment in dynamic
optimization and scalable hardware configurations help environments a challenge. Addressing these issues is essential
mitigate these constraints. The use of synthetic data generated for more broader and practical applications.
by GANs enhances the systems ability to detect underrep-
XI. DISCUSSION
resented attack types but poses a challenge in terms of
This study introduces a comprehensive and innovative
generalization to real-world scenarios. To prevent overfitting
framework for network intrusion detection that addresses
to synthetic patterns, the system incorporates diverse, contin-
critical challenges such as class imbalance, feature extraction,
uously updated datasets and periodic retraining, ensuring its
and model interpretability. The use of GANs to tackle
adaptability to evolving threats.
the class imbalance problem is a significant contribution,
Lastly, the integration of explainability through LIME
as it enables the generation of synthetic samples for under-
introduces a trade-off between interpretability and efficiency.
represented attack types, thereby improving the detection
While LIME provides valuable insights into the decision-
of minority-class intrusions that traditional methods often
making process, generating these explanations can introduce
miss. The independent application of LSTM and CNN
overhead in high-traffic environments. To balance this, the
architectures further strengthens the framework. LSTM
system applies explainability selectively, focusing on high-
demonstrates its ability to capture temporal dependencies
priority alerts, ensuring that operational performance is
in network traffic, making it well-suited for sequen-
maintained while preserving transparency in critical cases.
tial data analysis, while CNN efficiently extracts spatial
Overall, the framework carefully navigates these trade-offs to
features, providing complementary insights into intrusion
deliver a system that is not only accurate and robust but also
patterns.
practical and adaptable for deployment in modern, dynamic
A detailed ablation study evaluates the impact of key
network environments.
hyperparameters, such as loss functions and optimizers,
X. LIMITATIONS on the performance of the models. This investigation not only
The proposed GAN-CNN framework, despite its promising identifies the optimal configurations for LSTM and CNN
results, has several limitations. The applicability of synthetic but also serves as a guideline for future research aiming to
data generated by GANs to real-world attack patterns maximize model performance. The inclusion of Explainable
remains uncertain. The computational overhead from com- AI (XAI) through LIME is another noteworthy feature of
bining GANs, CNNs, LSTMs, and LIME makes real-time this framework. By highlighting the importance of features
deployment challenging, particularly in resource-constrained such as packet count, protocol type, and flow duration,
environments. Additionally, the trade-off between explain- LIME makes the decision-making process of the models
ability and performance may slow down intrusion responses transparent and interpretable. This is particularly valuable in
in high-traffic networks. While the system minimizes false practical settings, where trust and usability are critical for
negatives, the potential for false positives could overwhelm adoption.
analysts with unnecessary alerts. Furthermore, the framework
does not address zero-shot or unknown attack detection, XII. CONCLUSION AND FUTURE WORK
which could be achieved through reinforcement learning This research proposes a new NIDS framework to deal with
approaches. However, reinforcement learning introduces the critical problems in modern network security, including
challenges such as complex training dynamics, delayed the detection of complicated cyber threats and the class
reward feedback, and higher computational requirements, imbalance problem. Combining the strengths of GANs,
making it difficult to integrate into the current framework. CNNs, and LSTM models together, the proposed approach
On the positive side, our lightweight model contributes strengthens the detection capabilities of the minority attack
significantly to the system’s efficiency, offering an improved classes while assuring high classification accuracy for all
balance between computational complexity and detection classes. The integration of LIME increases transparency
performance. Lastly, its real-time effectiveness has yet to and interpretability, hence overcoming usability issues in

114998 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

real-world applications. With extensive evaluation using the [11] Z. Yang, X. Liu, T. Li, D. Wu, J. Wang, Y. Zhao, and H. Han, ‘‘A systematic
NF-CSE-CIC-IDS2018 dataset, the framework has shown an literature review of methods and datasets for anomaly-based network
intrusion detection,’’ Comput. Secur., vol. 116, May 2022, Art. no. 102675,
excellent performance where the LSTM model achieved a doi: 10.1016/[Link].2022.102675.
stunning accuracy of 99.67%, and the CNN model achieved [12] V. Hnamte and J. Hussain, ‘‘Dependable intrusion detection system using
an accuracy of 97.45%. Such a study epitomizes the impor- deep convolutional neural network: A novel framework and performance
evaluation approach,’’ Telematics Informat. Rep., vol. 11, Sep. 2023,
tance of using advanced machine-learning methodologies Art. no. 100077, doi: 10.1016/[Link].2023.100077.
to be proactive in the sophistication of cyber threats; for [13] A. Dunmore, J. Jang-Jaccard, F. Sabrina, and J. Kwak, ‘‘A comprehensive
network intrusion detection, it offers a resilient, flexible, and survey of generative adversarial networks (GANs) in cybersecurity
intrusion detection,’’ IEEE Access, vol. 11, pp. 76071–76094, 2023, doi:
interpretable approach. 10.1109/ACCESS.2023.3296707.
Our future work will focus on extending the proposed [14] C. Park, J. Lee, Y. Kim, J.-G. Park, H. Kim, and D. Hong, ‘‘An enhanced
framework to support real-time intrusion detection and AI-based network intrusion detection system using generative adversarial
networks,’’ IEEE Internet Things J., vol. 10, no. 3, pp. 2330–2345,
evaluating its performance on diverse datasets to ensure Feb. 2023, doi: 10.1109/JIOT.2022.3211346.
generalizability across different network environments. [15] M. Wang, N. Yang, N. J. Forcade-Perkins, and N. Weng, ‘‘Pro-
In addition, we plan to deploy the trained IDS models in Gen: Projection-based adversarial attack generation against network
intrusion detection,’’ IEEE Trans. Inf. Forensics Security, vol. 19,
a live network environment to test their performance in pp. 5476–5491, 2024, doi: 10.1109/TIFS.2024.3402155.
real-time traffic scenarios. This will help assess the system’s [16] W. Wang, Y. Sheng, J. Wang, X. Zeng, X. Ye, Y. Huang, and M. Zhu,
effectiveness in terms of detection speed, latency, and ‘‘HAST-IDS: Learning hierarchical spatial–temporal features using deep
neural networks to improve intrusion detection,’’ IEEE Access, vol. 6,
adaptability under real-world conditions. We also aim to pp. 1792–1806, 2018, doi: 10.1109/ACCESS.2017.2780250.
explore further optimization of GAN-generated samples, [17] S. Elsayed, K. Mohamed, and M. A. Madkour, ‘‘A comparative
experiment with lightweight models for deployment in study of using deep learning algorithms in network intrusion
detection,’’ IEEE Access, vol. 12, pp. 58851–58870, 2024, doi:
resource-constrained environments, and investigate federated 10.1109/ACCESS.2024.3389096.
or distributed learning approaches to enhance data privacy [18] H. Benaddi, K. Ibrahimi, A. Benslimane, M. Jouhari, and J. Qadir, ‘‘Robust
and scalability. enhancement of intrusion detection systems using deep reinforcement
learning and stochastic game,’’ IEEE Trans. Veh. Technol., vol. 71, no. 10,
pp. 11089–11102, Oct. 2022, doi: 10.1109/TVT.2022.3186834.
REFERENCES [19] M. He, X. Wang, P. Wei, L. Yang, Y. Teng, and R. Lyu, ‘‘Reinforcement
[1] T. Nandy, R. Md Noor, R. Kolandaisamy, M. Y. I. Idris, and learning meets network intrusion detection: A transferable and adaptable
S. Bhattacharyya, ‘‘A review of security attacks and intrusion detection framework for anomaly behavior identification,’’ IEEE Trans. Netw.
in the vehicular networks,’’ J. King Saud Univ.-Comput. Inf. Sci., vol. 36, Service Manage., vol. 21, no. 2, pp. 2477–2492, Apr. 2024, doi:
no. 2, Feb. 2024, Art. no. 101945, doi: 10.1016/[Link].2024.101945. 10.1109/TNSM.2024.3352586.
[2] S. Haider, A. Akhunzada, I. Mustafa, T. B. Patel, A. Fernandez, [20] M. Al-Fawa’reh, J. Abu-Khalaf, P. Szewczyk, and J. J. Kang, ‘‘MalBoT-
K. R. Choo, and J. Iqbal, ‘‘A deep CNN ensemble framework for efficient DRL: Malware botnet detection using deep reinforcement learning in
DDoS attack detection in software defined networks,’’ IEEE Access, vol. 8, IoT networks,’’ IEEE Internet Things J., vol. 11, no. 6, pp. 9610–9629,
pp. 53972–53983, 2020, doi: 10.1109/ACCESS.2020.2976908. Mar. 2024, doi: 10.1109/JIOT.2023.3324053.
[3] H. Kheddar, Y. Himeur, and A. I. Awad, ‘‘Deep transfer learning for [21] X. Ma and W. Shi, ‘‘AESMOTE: Adversarial reinforcement learning with
intrusion detection in industrial control networks: A comprehensive SMOTE for anomaly detection,’’ IEEE Trans. Netw. Sci. Eng., vol. 8, no. 2,
review,’’ J. Netw. Comput. Appl., vol. 220, Nov. 2023, Art. no. 103760, doi: pp. 943–956, Apr. 2021, doi: 10.1109/TNSE.2020.3004312.
10.1016/[Link].2023.103760. [22] I. S. Bangroo and R. Kumar, ‘‘Zérosdetect: Phishing URL detection
[4] S. Fraihat, S. Makhadmeh, M. Awad, M. A. Al-Betar, and with quantum-driven zero-shot learning,’’ in Proc. 9th Int. Conf.
A. Al-Redhaei, ‘‘Intrusion detection system for large-scale IoT NetFlow Signal Process. Commun. (ICSC), Dec. 2023, pp. 498–503, doi:
networks using machine learning with modified arithmetic optimization 10.1109/ICSC60394.2023.10440725.
algorithm,’’ Internet Things, vol. 22, Jul. 2023, Art. no. 100819, doi: [23] R. Desai and T. G. Venkatesh, ‘‘Robust network intrusion detection systems
10.1016/[Link].2023.100819. for outlier detection,’’ in Proc. IEEE 27th Int. Workshop Comput. Aided
[5] J. Verma, A. Bhandari, and G. Singh, ‘‘INIDS: SWOT analysis and Model. Design Commun. Links Netw. (CAMAD), Paris, France, Nov. 2022,
TOWS inferences of state-of-the-art NIDS solutions for the development pp. 140–146, doi: 10.1109/CAMAD55695.2022.9966883.
of intelligent network intrusion detection system,’’ Comput. Commun., [24] Y. Yan, Y. Yang, Y. Gu, and F. Shen, ‘‘A few-shot intrusion detection model
vol. 195, pp. 227–247, Nov. 2022, doi: 10.1016/[Link].2022.08.022. for the Internet of Things,’’ in Proc. 3rd Int. Conf. Electron. Inf. Eng.
[6] C. Zhang, D. Jia, L. Wang, W. Wang, F. Liu, and A. Yang, ‘‘Comparative Comput. Sci. (EIECS), Changchun, China, Sep. 2023, pp. 531–537, doi:
research on network intrusion detection methods based on machine 10.1109/EIECS59936.2023.10435498.
learning,’’ Comput. Secur., vol. 121, Oct. 2022, Art. no. 102861, doi: [25] J. Lee and K. Park, ‘‘GAN-based imbalanced data intrusion detection
10.1016/[Link].2022.102861. system,’’ Pers. Ubiquitous Comput., vol. 25, no. 1, pp. 121–128, Nov. 2019,
[7] M. Anwer, G. Ahmed, A. Akhunzada, and S. Siddiqui, ‘‘Intrusion doi: 10.1007/s00779-019-01332-y.
detection using deep learning,’’ in Proc. Int. Conf. Electr., Comput., [26] U. Sabeel, S. S. Heydari, K. El-Khatib, and K. Elgazzar, ‘‘Incre-
Commun. Mechatronics Eng. (ICECCME), Oct. 2021, pp. 1–6, doi: mental adversarial learning for polymorphic attack detection,’’ IEEE
10.1109/ICECCME52200.2021.9590852. Trans. Mach. Learn. Commun. Netw., vol. 2, pp. 869–887, 2024, doi:
[8] F. S. Alrayes, M. Zakariah, S. U. Amin, Z. I. Khan, and J. S. 10.1109/TMLCN.2024.3418756.
Alqurni, ‘‘Network security enhanced with deep neural network-based [27] A. Ayantayo, A. Kaur, A. Kour, X. Schmoor, F. Shah, I. Vickers, P. Kearney,
intrusion detection system,’’ Comput., Mater. Continua, vol. 80, no. 1, and M. M. Abdelsamea, ‘‘Network intrusion detection using feature fusion
pp. 1457–1490, 2024, doi: 10.32604/cmc.2024.051996. with deep learning,’’ J. Big Data, vol. 10, no. 1, p. 167, Nov. 2023, doi:
[9] Y. Ban, D. Zhang, Q. He, and Q. Shen, ‘‘APSO-CNN-SE: An adaptive 10.1186/s40537-023-00834-0.
convolutional neural network approach for IoT intrusion detection,’’ [28] L. Ashiku and C. Dagli, ‘‘Network intrusion detection system using deep
Comput., Mater. Continua, vol. 81, no. 1, pp. 567–601, 2024, doi: learning,’’ Proc. Comput. Sci., vol. 185, pp. 239–247, Jan. 2021, doi:
10.32604/cmc.2024.055007. 10.1016/[Link].2021.05.025.
[10] M. Gamal, M. Elhamahmy, S. Taha, and H. Elmahdy, ‘‘Improving [29] A. R. Khan, M. Kashif, R. H. Jhaveri, R. Raut, T. Saba, and S. A. Bahaj,
intrusion detection using LSTM-RNN to protect drones’ networks,’’ ‘‘Deep learning for intrusion detection and security of Internet of Things
Egyptian Informat. J., vol. 27, Sep. 2024, Art. no. 100501, doi: (IoT): Current analysis, challenges, and possible solutions,’’ Secur. Com-
10.1016/[Link].2024.100501. mun. Netw., vol. 2022, pp. 1–13, Jul. 09, 2022, doi: 10.1155/2022/4016073.

VOLUME 13, 2025 114999

 M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

[30] Q. Chen, D. He, Z. Jin, Z. Ren, T. Liu, and S. Shan, ‘‘MSRNet-GLAM: [49] A. Elhanashi, K. Gasmi, A. Begni, P. Dini, Q. Zheng, and S. Saponara,
A novel intrusion detection method for train communication network,’’ ‘‘Machine learning techniques for anomaly-based detection system on
Simul. Model. Pract. Theory, vol. 138, Jan. 2025, Art. no. 103040, doi: CSE-CIC-IDS2018 dataset,’’ in Applications in Electronics Pervading
10.1016/[Link].2024.103040. Industry, Environment and Society (Lecture Notes in Electrical Engineer-
[31] A. Ali, M. Assam, F. U. Khan, Y. Y. Ghadi, Z. Nurdaulet, ing). Cham, Switzerland: Springer, 2023, pp. 131–140, doi: 10.1007/978-
A. Zhibek, S. Y. Shah, and T. J. Alahmadi, ‘‘An optimized multilayer 3-031-30333-3_17.
perceptron-based network intrusion detection using gray wolf [50] M. S. Al-kahtani, Z. Mehmood, T. Sadad, I. Zada, G. Ali, and
optimization,’’ Comput. Electr. Eng., vol. 120, Dec. 2024, Art. no. 109838, M. ElAffendi, ‘‘Intrusion detection in the Internet of Things using fusion
doi: 10.1016/[Link].2024.109838. of GRU-LSTM deep learning model,’’ Intell. Autom. Soft Comput., vol. 37,
[32] P. T. Duy, D. T. T. Hien, T. D. Luong, N. H. Quyen, and no. 2, pp. 2279–2290, 2023, doi: 10.32604/iasc.2023.037673.
V.-H. Pham, ‘‘Fed-evolver: An automated evolving approach for federated [51] S. S. Bamber, A. V. R. Katkuri, S. Sharma, and M. Angurala,
intrusion detection system using adversarial autoencoder in SDN-enabled ‘‘A hybrid CNN-LSTM approach for intelligent cyber intrusion detection
networks,’’ Internet Things, vol. 28, Dec. 2024, Art. no. 101397, doi: system,’’ Comput. Secur., vol. 148, Jan. 2025, Art. no. 104146, doi:
10.1016/[Link].2024.101397. 10.1016/[Link].2024.104146.
[33] S. Sharma, V. Kumar, and K. Dutta, ‘‘Multi-objective optimization [52] L. Mhamdi and M. M. Isa, ‘‘Securing SDN: Hybrid autoencoder-
algorithms for intrusion detection in IoT networks: A systematic review,’’ random forest for intrusion detection and attack mitigation,’’
Internet Things Cyber-Phys. Syst., vol. 4, pp. 258–267, Jan. 2024, doi: J. Netw. Comput. Appl., vol. 225, May 2024, Art. no. 103868, doi:
10.1016/[Link].2024.01.003. 10.1016/[Link].2024.103868.
[34] A. Sherstinsky, ‘‘Fundamentals of recurrent neural network [53] M. S. ElSayed, N.-A. Le-Khac, M. A. Albahar, and A. Jurcut, ‘‘A novel
(RNN) and long short-term memory (LSTM) network,’’ Phys. D: hybrid model for intrusion detection systems in SDNs based on CNN and a
Nonlinear Phenomena, vol. 404, Mar. 2020, Art. no. 132306, doi: new regularization technique,’’ J. Netw. Comput. Appl., vol. 191, Oct. 2021,
10.1016/[Link].2019.132306. Art. no. 103160, doi: 10.1016/[Link].2021.103160.
[35] V. Vimbi, N. Shaffi, and M. Mahmud, ‘‘Interpreting artificial intelligence [54] M. M. Hoque, K. Alam, M. F. Monir, and M. Tarek Habib, ‘‘Deep learning-
models: A systematic review on the application of LIME and SHAP based trojan detection in network traffic: A CNN-BiLSTM approach,’’ in
in Alzheimer’s disease detection,’’ Brain Inform., vol. 11, no. 1, p. 10, Proc. IEEE 100th Veh. Technol. Conf. (VTC-Fall), Oct. 2024, pp. 1–5, doi:
Apr. 2024, doi: 10.1186/s40708-024-00222-1. 10.1109/VTC2024-Fall63153.2024.10757577.
[36] Y. Yu, X. Si, C. Hu, and J. Zhang, ‘‘A review of recurrent neural networks:
LSTM cells and network architectures,’’ Neural Comput., vol. 31, no. 7,
pp. 1235–1270, Jul. 2019, doi: 10.1162/neco_a_01199.
[37] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S.
Ozair, A. Courville, and Y. Bengio, ‘‘Generative adversarial networks,’’
Commun. ACM, vol. 63, no. 11, pp. 139–144, Oct. 22, 2020, doi:
10.1145/3422622.
[38] L. Huang, J. Qin, Y. Zhou, F. Zhu, L. Liu, and L. Shao, ‘‘Normalization MD JUNAYED HOSSAIN received the [Link].
techniques in training DNNs: Methodology, analysis and application,’’ degree in computer science and engineering (CSE)
IEEE Trans. Pattern Anal. Mach. Intell., vol. 45, no. 8, pp. 10173–10196, from Independent University Bangladesh (IUB).
Aug. 2023, doi: 10.1109/TPAMI.2023.3250241. He is an Adjunct Lecturer in CSE with IUB,
[39] S. Bourou, A. El Saer, T.-H. Velivassaki, A. Voulkidis, and T. Zahariadis, Previously, he was a Graduate Research Engineer,
‘‘A review of tabular data synthesis using GANs on an IDS dataset,’’ contributed to a project on stroke biomarker
Information, vol. 12, no. 9, p. 375, Sep. 2021, doi: 10.3390/info12090375.
identification via biomedical signal processing.
[40] M. K. Dahouda and I. Joe, ‘‘A deep-learned embedding
Currently, he is exploring research in intrusion
technique for categorical features encoding,’’ IEEE Access, vol. 9,
detection and medical image processing and is
pp. 114381–114391, 2021, doi: 10.1109/ACCESS.2021.3104357.
actively seeking Ph.D. opportunities. His research
[41] L. G. Wright, T. Onodera, M. M. Stein, T. Wang, D. T. Schachter,
Z. Hu, and P. L. McMahon, ‘‘Deep physical neural networks trained with
spans biomedical signal processing, machine learning, computer vision, and
backpropagation,’’ Nature, vol. 601, no. 7894, pp. 549–555, Jan. 26, 2022, NLP, with IEEE publications on topics, such as Bangla speech emotion
doi: 10.1038/s41586-021-04223-6. recognition and satellite image classification.
[42] M. Sarhan, S. Layeghy, N. Moustafa, and M. Portmann, ‘‘NetFlow datasets
for machine learning-based network intrusion detection systems,’’ in
Big Data Technologies and Applications (Lecture Notes of the Institute
for Computer Sciences, Social Informatics and Telecommunications
Engineering). Springer, 2021, pp. 117–135, doi: 10.1007/978-3-030-
72802-1_9.
[43] K. Jiang, W. Wang, A. Wang, and H. Wu, ‘‘Network intrusion detection KHORSHED ALAM (Member, IEEE) received
combined hybrid sampling with deep hierarchical network,’’ IEEE the [Link]. degree in computer science and engi-
Access, vol. 8, pp. 32464–32476, 2020, doi: 10.1109/ACCESS.2020. neering (CSE) from East Delta University (EDU),
2973730. and the [Link]. degree in CSE from United Inter-
[44] L. Dhanabal and S. P. Shanthara, ‘‘A study on NSL-KDD dataset for national University (UIU). He has two years of
intrusion detection system based on classification algorithms,’’ Int. J. Adv. professional experience as a Software Engineer,
Res. Comput. Commun. Eng., vol. 4, no. 6, pp. 446–452, 2015.
specializing in android development. He was
[45] M. Vishwakarma and N. Kesswani, ‘‘DIDS: A deep neural network based
also a Research Assistant (RA) with Independent
real-time intrusion detection system for IoT,’’ Decis. Anal. J., vol. 5,
University Bangladesh (IUB), where he honed
Dec. 2022, Art. no. 100142, doi: 10.1016/[Link].2022.100142.
his research skills. His primary areas of inter-
[46] M. Abdallah, N. An Le Khac, H. Jahromi, and A. Delia Jurcut, ‘‘A hybrid
CNN-LSTM based approach for anomaly detection systems in SDNs,’’ ests include artificial intelligence, machine learning, signal processing,
in Proc. 16th Int. Conf. Availability, Rel. Secur., Aug. 2021, pp. 1–7, doi: human–computer interaction, med–tech, computer networks, and software
10.1145/3465481.3469190. engineering. He is passionate about leveraging technology for innovative
[47] M. S. Elsayed, N.-A. Le-Khac, and A. D. Jurcut, ‘‘InSDN: A novel SDN solutions and impactful research. He is actively seeking Ph.D. opportunities
intrusion dataset,’’ IEEE Access, vol. 8, pp. 165263–165284, 2020, doi: in the domains of artificial intelligence, machine learning, signal processing,
10.1109/ACCESS.2020.3022633. human–computer interaction, med–tech, computer networks, and software
[48] B. Cao, C. Li, Y. Song, Y. Qin, and C. Chen, ‘‘Network intrusion detection engineering. His academic excellence has been recognized through several
model based on CNN and GRU,’’ Appl. Sci., vol. 12, no. 9, p. 4184, prestigious awards, including the Emerging Leader Award 2024, the Dean’s
Apr. 2022, doi: 10.3390/app12094184. List Award, and multiple Merit Scholarships.

115000 VOLUME 13, 2025

M. J. Hossain et al.: Explainable AI Meets Synthetic Data: A Deep Learning Framework

MD FAHAD MONIR (Member, IEEE) received TAREM AHMED (Senior Member, IEEE)
the [Link]. degree (Hons.) in communication received the degree in physics and economics
engineering from International Islamic University (summa cum laude) from the Middlebury College,
Malaysia (IIUM), Malaysia, in 2014, the double USA, the master’s degree in electrical engineering
[Link]. degree in information technology from from the Ivy League University of Pennsylvania,
the KTH Royal Institute of Technology, Sweden, USA, and the Ph.D. degree in computer science
in 2016, and the [Link]. degree in communication from International Islamic University Malaysia,
engineering from the University of Trento, Italy, Malaysia. During various stages in his career,
in 2017. He is currently pursuing the Ph.D. he has worked in industrial product development
degree in electrical and computer engineering with in the Silicon Valley area of California, USA, and
Virginia Tech, USA. From 2018 to 2019, he was a full-time Lecturer with in academic research with McGill University, Canada, and ETH Zürich,
American International University of Bangladesh. Since 2019, he has been a Switzerland, before returning to Dhaka, Bangladesh. He has presented
Senior Lecturer with the Department of Computer Science and Engineering, in research workshops at various international universities, such as the
Independent University Bangladesh. His current research interest includes University of Naples Federico II, Italy, and the École Normale Supérieure
software-defined networking. (ENS), France. He served as an Erasmus+ Visiting Scholar with Middle
East Technical University, Türkiye.

MD MOZAMMAL HOQUE (Member, IEEE)

received the dual master’s degrees, one in informa-
tion systems security from Bangladesh University
of Professionals (BUP), Bangladesh, and another
in engineering technology from the University
of Houston, USA. He is currently pursuing the
Ph.D. degree in computer engineering. He is a
focused professional with over 15 years of hands-
on expertise in the Internet and communication
sectors. He has worked across a broad range
of advanced technologies, with deep industry knowledge in network
infrastructure, cybersecurity, and modern communication systems. He
previously served at Agni Systems Ltd. He also serves as an Instructional
Assistant with the Department of Engineering Technology. His primary
research interests include network communication, cybersecurity, software-
defined networking (SDN), machine learning (ML), and the Internet of
Things (IoT). At present, his work focuses on the intersection of network
security and machine learning.

VOLUME 13, 2025 115001