Abstract

Due to the increasing prevalence of network attacks, maintaining network security has become significantly more challenging. An Intrusion Detection System (IDS) is a critical tool for addressing security vulnerabilities. IDSs play a vital role in monitoring network traffic and identifying malicious activities. However, two major challenges hinder IDS performance: data imbalance, which weakens the detection of minority class attacks, and overfitting in traditional classifiers such as Support Vector Machines (SVM). This study proposes a novel and transparent IDS framework that integrates several advanced techniques: Variational Autoencoder (VAE) for data augmentation, Mutual Information-based feature selection, Harris Hawks Optimization (HHO) for hyperparameter tuning of the SVM, and SHAP (SHapley Additive exPlanations) for interpretability. VAE is utilized to generate synthetic instances for minority classes, effectively addressing class imbalance. Feature selection is employed to reduce dimensionality and enhance generalization performance. The HHO algorithm is used to adaptively tune the hyperparameters of the SVM, thereby optimizing classification accuracy while mitigating overfitting. Finally, SHAP values are employed to interpret the SVM’s decisions, enhancing the transparency and trustworthiness of the system. Experimental evaluations conducted on two benchmark IDS datasets, UNSW-NB15 and NSL-KDD, demonstrate that the proposed VAE-HHO-SVM framework outperforms existing models in terms of accuracy, robustness, and interpretability. The results confirm the effectiveness of combining optimization, explainable AI, and data balancing strategies in modern IDS development. Specifically, the proposed method achieves an accuracy of 98.42% on the NSL-KDD dataset and 97.45% on the UNSW-NB15 dataset—an improvement of 3.17% over other methods.