AI-Powered Intrusion Detection with SHAP Explainability and Feedback Loop: A Modular Pipeline for Cyber Threat Classification

Intrusion Detection Systems (IDS) are fundamental to protecting digital infrastructure against increasingly sophisticated cyber threats. While conventional machine learning approaches for IDS often suffer from limitations including static decision-making pipelines, inherent model opacity, and difficulty in adapting to novel attack vectors, this work introduces a novel, modular, interpretable, and adaptive AI pipeline for robust threat classification. Leveraging the well-established CICIDS2017 benchmark dataset, we construct an end-to-end framework that integrates high-performance Random Forest and XGBoost classifiers with SHAP (SHapley Additive exPlanations) for comprehensive feature attribution. Crucially, the pipeline incorporates a feedback-driven closed-loop mechanism enabling dynamic model retraining and adaptation to evolving threat landscapes. This integrated architecture not only achieves exceptionally high classification performance, with the XGBoost model yielding 99.96% accuracy and a 0.92 Macro F1-score across 15 diverse attack types, but also significantly enhances the transparency, maintainability, and real-world adaptability required for modern security operations. We provide detailed insights into model behavior and data characteristics through extensive SHAP analysis, t-SNE clustering visualizations, and a comprehensive class-wise performance breakdown, demonstrating the system's effectiveness in handling significant class imbalance and improving generalization. The resulting pipeline is engineered to be deployable, inherently interpretable, and ready for integration into production-scale cybersecurity environments, offering a significant step towards trustworthy and resilient AI-powered IDS.