Explainable AI for Cloud Intrusion Detection: A User Study of SHAP and LIME in AWS GuardDuty

Cloud-based intrusion detection systems, such as AWS GuardDuty, provide effective threat detection but often lack transparency, which undermines analyst trust and incident response capabilities. This paper evaluates the integration of XAI techniques, specifically SHAP and LIME, into AWS GuardDuty alert triage workflow to enhance interpretability. An XGBoost model trained on the CIC-IDS2017 dataset was used to generate explanations for security alerts presented to twelve security professionals, divided into two groups: control and XAI-supported. Participants classified four attack types while providing confidence ratings and justifications for their decisions. Results show that analysts with XAI access achieved higher classification accuracy, with three participants correctly classifying all alerts, compared to none in the control group. They also demonstrated increased confidence levels and more elaborate reasoning. However, participants encountered varying difficulty interpreting SHAP and LIME visualizations, with LIME proving more immediately actionable for alert-specific analysis while SHAP’s global insights presented a steeper learning curve. These findings highlight both the potential and practical challenges of deploying XAI in operational cloud security environments.