Mind the Gap: On the Practical Utility of SHAP for Deep Learning-Based Intrusion Detection

The increasing sophistication of cyber threats necessitates the use of advanced techniques like Deep Learning (DL) for Network Intrusion Detection Systems (NIDS. While DL models achieve high accuracy, their “black-box” nature hinders their adoption in real-world security operations, where transparency and trust are paramount. This paper investigates the practical challenges of applying Explainable AI (xAI) to this problem by critically analyzing the outputs of a standard xAI framework on a high-performance NIDS model. We use a Deep Neural Network (DNN) trained on the widelyused CIC-IDS-2017 dataset as a baseline model, achieving an F1-score of 0.99 for attack detection. We then employ SHAP to scrutinize the operational utility of the generated explanations. Our analysis reveals a critical “last-mile” problem in explainability, demonstrating that raw, unprocessed xAI outputs can be unintelligible to security practitioners due to standard data preprocessing steps like feature scaling. The results show that while xAI can identify influential features, significant postprocessing and contextualization are required to translate these outputs into genuinely transparent and actionable insights, highlighting a crucial gap between theoretical explainability and practical application in cybersecurity.