update

README.md

@@ -8,27 +8,184 @@ app_file: app.py
 pinned: false
 ---
 
-# IDS - XAI Dashboard
+# 🛡️ Intrusion Detection System with Explainable AI
 
-**Intrusion Detection System** berbasis LightGBM dengan Explainable AI (SHAP) dan narasi LLM.
+An interactive, machine-learning-based Intrusion Detection System (IDS) dashboard built with **Streamlit**, using the **CIC-IDS-2017** dataset. The application classifies network traffic with a trained **LightGBM** model, explains model predictions with **SHAP**, and turns the technical findings into a natural-language explanation using **GPT-4o-mini**.
 
-## Stack
-- **Model**: LightGBM, ditraining pada CIC-IDS-2017
-- **XAI**: SHAP TreeExplainer
-- **LLM**: GPT-4o-mini (OpenAI)
-- **Framework**: Streamlit
+🔗 **Live demo:** [IDS – XAI Dashboard](https://huggingface.co/spaces/aisyahn/ids-dashboard)
 
-## Struktur File
+## Overview
 
-```
-├── app.py                     
-├── requirements.txt 
+Traditional machine-learning IDS models can be difficult to interpret because their predictions do not always explain why a traffic sample is classified as benign or malicious. This project combines model-based intrusion detection with Explainable AI (XAI) and a Large Language Model (LLM) to make individual predictions easier to understand.
+
+The dashboard provides an interactive workflow for entering network-traffic feature values, viewing the predicted class and confidence, inspecting feature contributions, and reading a contextual explanation in Indonesian.
+
+## Key Features
+
+- **Multi-class traffic classification** using a trained LightGBM model.
+- **Quick Presets** for Normal Traffic (BENIGN), DoS Hulk, PortScan, and Bot examples, alongside a Custom option.
+- **Manual feature input** for key network-traffic attributes.
+- **Advanced Input** to select and override additional model features.
+- **Prediction results** with the predicted class, confidence score, severity label, and top class probabilities.
+- **SHAP-based explainability** with a feature-contribution chart and a list of the top contributing features.
+- **LLM-generated explanation** using GPT-4o-mini to describe the prediction, interpret relevant traffic indicators, and suggest a response when an attack is detected.
+
+## Tech Stack
+
+| Component | Technology |
+|---|---|
+| Programming language | Python |
+| Web application | Streamlit |
+| Main classification model | LightGBM |
+| Model explainability | SHAP TreeExplainer |
+| LLM explanation | OpenAI GPT-4o-mini |
+| Data processing | pandas, NumPy |
+| Model/artifact loading | joblib |
+| Visualization | Matplotlib |
+| Dataset | CIC-IDS-2017 |
+
+## Model Information
+
+The deployed dashboard uses **LightGBM** as its primary classifier. The repository also contains Random Forest and XGBoost model artifacts for the model-comparison work.
+
+The dashboard displays the following model metrics in its sidebar:
+
+| Metric | Value |
+|---|---:|
+| Accuracy | 99.8% |
+| Macro Precision | 0.878 |
+| Macro Recall | 0.953 |
+| Macro F1-score | 0.905 |
+
+These are the values currently displayed by the application. Refer to the accompanying evaluation artifacts and notebooks for the model-selection and analysis workflow.
+
+## Repository Structure
+
+```text
+ids-dashboard/
+├── app.py
+├── requirements.txt
+├── model_results.csv
+├── predictions.pkl
+├── results.pkl
+├── data/
+│   ├── feature_columns.json
+│   ├── preset_samples.json
+│   └── shap_per_class.json
 ├── models/
 │   ├── LightGBM.pkl
+│   ├── RandomForest.pkl
+│   ├── XGBoost.pkl
 │   ├── label_encoder.pkl
 │   └── shap_explainer.pkl
-└── data/
-    ├── feature_columns.json
-    ├── preset_samples.json
-    └── shap_per_class.json
-```
+└── notebook/
+    ├── model_selection.ipynb
+    └── shap_llm.ipynb
+```
+
+- `app.py` — Streamlit application, prediction pipeline, SHAP visualization, and LLM integration.
+- `data/` — feature-column definitions, preset traffic samples, and SHAP information.
+- `models/` — trained model artifacts, label encoder, and SHAP explainer.
+- `notebook/` — notebooks for model selection and SHAP/LLM analysis.
+- `model_results.csv`, `predictions.pkl`, and `results.pkl` — saved model evaluation and prediction-related artifacts.
+
+## Run Locally
+
+### 1. Clone the repository
+
+```bash
+git clone https://huggingface.co/spaces/aisyahn/ids-dashboard
+cd ids-dashboard
+```
+
+### 2. Create and activate a virtual environment (recommended)
+
+**Windows (PowerShell):**
+
+```powershell
+python -m venv .venv
+.venv\Scripts\Activate.ps1
+```
+
+**macOS / Linux:**
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+```
+
+### 3. Install dependencies
+
+```bash
+pip install -r requirements.txt
+```
+
+### 4. Configure the OpenAI API key
+
+The application uses the `OPENAI_API_KEY` environment variable for GPT-4o-mini explanations. Set your key locally before starting the app.
+
+**Windows (PowerShell):**
+
+```powershell
+$env:OPENAI_API_KEY="your-api-key"
+```
+
+**macOS / Linux:**
+
+```bash
+export OPENAI_API_KEY="your-api-key"
+```
+
+Do not commit API keys or other credentials to the repository. For Hugging Face Spaces, add `OPENAI_API_KEY` under the Space's **Settings → Variables and secrets → Secrets**.
+
+If the API key is not configured, the IDS prediction and SHAP workflow can still run, but the LLM explanation will not be available.
+
+### 5. Start the dashboard
+
+```bash
+streamlit run app.py
+```
+
+Streamlit will provide a local URL in the terminal, usually `http://localhost:8501`.
+
+## How to Use the Dashboard
+
+1. Open the [live dashboard](https://huggingface.co/spaces/aisyahn/ids-dashboard).
+2. Select a Quick Preset, or choose **Custom** to enter your own traffic-feature values.
+3. Adjust the displayed network-traffic features.
+4. Optionally expand **Advanced Input** to select and edit additional features.
+5. Click **Analyze Traffic**.
+6. Review the predicted traffic class, confidence score, severity, and class probabilities.
+7. Inspect the SHAP chart and top contributing features.
+8. Read the generated natural-language explanation and suggested action, when the OpenAI API key is configured.
+
+## Explainability Workflow
+
+The dashboard combines two complementary explanation layers:
+
+1. **SHAP** estimates the contribution of input features to the model's prediction and presents the most influential features.
+2. **GPT-4o-mini** receives the predicted class, confidence score, top SHAP features, and selected traffic values to generate a short Indonesian explanation with contextual interpretation and a suggested action.
+
+The LLM is used as an interpretation layer; the traffic classification itself is produced by the trained LightGBM model.
+
+## Dataset
+
+This project uses **CIC-IDS-2017**, a network-intrusion detection dataset containing benign traffic and multiple attack categories. The dataset is used for training and evaluating the machine-learning models.
+
+Please refer to the dataset's original publication and distribution terms when reusing the data. This repository contains model and application artifacts; it does not include the full raw CIC-IDS-2017 dataset.
+
+## Notes and Limitations
+
+- This is an academic/research prototype and should not be treated as a standalone production security system.
+- Predictions depend on the quality, scale, and meaning of the input features. Inputs should follow the feature definitions and preprocessing expected by the trained model.
+- The LLM-generated narrative is an additional interpretation and may be incomplete or inaccurate. Verify security decisions with appropriate network evidence and security expertise.
+- The application accepts manually entered feature values and preset examples; it is not currently a live packet-capture or continuous network-monitoring system.
+- Keep the OpenAI API key private and monitor API usage.
+
+## Author
+
+**Aisyah Nabillah**  
+Computer Science, BINUS Online – Universitas Bina Nusantara
+---
+
+*Developed as an academic project exploring the integration of machine learning, Explainable AI, and Large Language Models for network intrusion detection.*

index.html

@@ -0,0 +1,90 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="description" content="Research paper on a machine learning intrusion detection system with explainable AI and large language models.">
+  <title>MACHINE LEARNING INTRUSION DETECTION SYSTEM WITH EXPLAINABLE AI AND LARGE LANGUAGE MODEL</title>
+  <link rel="stylesheet" href="style.css">
+</head>
+<body>
+  <header class="hero">
+    <div class="eyebrow">Research Paper · Cybersecurity · Explainable AI</div>
+    <h1>MACHINE LEARNING INTRUSION DETECTION SYSTEM WITH EXPLAINABLE AI AND LARGE LANGUAGE MODEL</h1>
+    <p class="author">Aisyah Nabillah</p>
+    <p class="affiliation">Computer Science Study Program, BINUS Online, Universitas Bina Nusantara, Jakarta, Indonesia 11480</p>
+    <a class="email" href="mailto:aisyah.nabillah@binus.ac.id">aisyah.nabillah@binus.ac.id</a>
+  </header>
+  <main class="paper">
+    <div class="reading-note"> </div>
+    
+
+
+<h2><strong>ABSTRACT</strong></h2>
+<p><em>Intrusion Detection Systems (IDS) based on machine learning face interpretability limitations because most models are black-box, making it difficult for security analysts to understand classification decisions. This study developed an IDS using three machine learning algorithms</em><em>, </em><em>Random Forest, </em><em>XGBoost</em><em>, and </em><em>LightGBM</em><em>, </em><em>on the CIC-IDS-2017 dataset containing 2,830,743 network traffic instances across 15 classes. Methods include SMOTE for class imbalance handling, SHAP </em><em>TreeExplainer</em><em> for model interpretability, and integration of GPT-4o-mini Large Language Model (LLM) with a selective explanation approach, where the LLM is invoked only once at the end of the pipeline as a SHAP interpreter. </em><em>LightGBM</em><em> achieved the best performance with a Macro F1-score of 0.91, surpassing </em><em>XGBoost</em><em> (0.88) and Random Forest (0.80). SHAP stability evaluation demonstrated </em><em>Jaccard Similarity of 1.000 for three attack classes and Spearman Rank Correlation above 0.995 across all classes, confirming reliable and reproducible explanations. LLM narrative quality achieved average Completeness of 95%, Fluency of 4.75/5, and Conciseness of 4.50/5, with all five qualitative rubric criteria met across four test scenarios. Dashboard usability evaluation showed all six checklist aspects fulfilled. The system was deployed as an interactive </em><em>Streamlit</em><em> dashboard on Hugging Face Spaces. The selective explanation approach successfully integrates SHAP and LLM efficiently, producing natural language explanations more informative and accessible than SHAP output alone, supporting Hypothesis H1.</em></p>
+<p class="meta-line"><strong>Keywords: </strong>Intrusion Detection System, Machine Learning, LightGBM, SHAP, Large Language Model, Explainable AI, Selective Explanation</p>
+<p class="meta-line"><strong>SDG: </strong>9 (Industry, Innovation and Infrastructure)</p>
+<h2><strong>INTRODUCTION</strong></h2>
+<p>Network security has become a critical aspect as cyberattacks grow in frequency and sophistication. Intrusion Detection Systems (IDS) are essential components of network security infrastructure, tasked with monitoring traffic to detect suspicious activities. According to the IBM Cost of a Data Breach Report 2025, the global average cost of a data breach reached USD 4.44 million in 2025, while the United States recorded an all-time high of USD 10.22 million, a 9% increase over the previous year (IBM, 2025). These figures underscore the escalating financial consequences of inadequate network security, reinforcing the critical need for reliable and interpretable intrusion detection systems.</p>
+<p>Machine learning has significantly advanced IDS capabilities beyond the limitations of signature-based approaches. Maseer et al., (2021) conducted a comprehensive benchmark of 31 machine learning models on the CICIDS2017 dataset, demonstrating that ensemble boosting algorithms consistently deliver the best performance across diverse attack categories. However, most of these models are black-box in nature, making it difficult for security analysts to understand the reasoning behind each detection decision, a critical requirement for trust and actionability in operational settings.</p>
+<p>Explainable Artificial Intelligence (XAI) has emerged as a key approach to improving the interpretability of black-box models. Salih et al., (2025) emphasize that the success of machine learning models must be accompanied by the ability to explain how, why, and when a model produces a particular decision. SHAP (SHapley Additive exPlanations) is among the most widely used XAI methods due to its strong theoretical foundation in cooperative game theory and its ability to provide consistent individual-level explanations Naudot et al., (2025). Although SHAP can quantitatively identify feature contributions, its output, numeric values and bar charts, remains difficult for non-technical analysts to interpret.</p>
+<p>Large Language Models (LLMs) offer the ability to generate human-readable explanations. Khediri et al., (2024) combined machine learning with SHAP and LLM to improve IDS interpretability, but their approach invokes the LLM on all prediction outputs, raising computational efficiency concerns. Houssel et al., (2026) developed the eX-NIDS framework that applies an LLM to every case in the IDS pipeline, but the high per-call cost limits its applicability in real-world deployments. Zeng &amp; Zhu, (2026) further demonstrate that integrating SHAP with LLMs can meaningfully improve the understandability of model decisions for end users.</p>
+<p>This study aims to: (1) develop a machine learning-based IDS using three algorithms (Random Forest, XGBoost, LightGBM) on the CIC-IDS-2017 dataset; (2) compare the performance of all three algorithms; (3) apply SHAP TreeExplainer for model interpretability; and (4) integrate GPT-4o-mini via a selective explanation approach to produce efficient natural language explanations. The research hypothesis states that explanations generated through the integration of SHAP and LLM have a higher degree of clarity and relevance than SHAP-only explanations (H1). This work contributes to advancing XAI for network security while providing a more transparent and accessible IDS dashboard for analysts of varying technical backgrounds.</p>
+<h2><strong>RESEARCH METHODOLOGY</strong></h2>
+<h2><figure class="figure"><img src="assets/figure-4.png" alt="Research figure"><figcaption>Research figure</figcaption></figure></h2>
+<p class="caption">Figure 1 Research Pipeline Flowchart</p>
+<p>This research employs an experimental approach using the CIC-IDS-2017 dataset accessed via HuggingFace (bvsam/cic-ids-2017, subset machine_learning). The dataset contains 2,830,743 instances with 78 numerical features across 15 classes including BENIGN and 14 attack types. The research pipeline consists of six stages as described below.</p>
+<h2><figure class="figure"><img src="assets/figure-3.png" alt="Research figure"><figcaption>Research figure</figcaption></figure></h2>
+<p class="caption">Figure 2 System Architecture of the IDS Pipeline (Three-Layer Design)</p>
+<p><strong>Data Preprocessing. </strong>Missing values were replaced using column medians, and infinite values were converted to NaN. Labels were encoded using LabelEncoder. The dataset was split 80:20 using stratified sampling to ensure proportional class distribution across training and test sets.</p>
+<p><strong>Class Imbalance Handling. </strong>SMOTE with sampling_strategy=&#x27;not majority&#x27; and k_neighbors=3 was applied only to training data to prevent data leakage. Balanced class weights were also applied during training. After balancing, training data increased from 2,264,594 to 27,277,155 instances.</p>
+<p><strong>Model Training. </strong>Three algorithms were trained and compared: Random Forest (n_estimators=100, max_depth=15), XGBoost (n_estimators=120, GPU acceleration, eval_metric=&#x27;mlogloss&#x27;), and LightGBM (n_estimators=120, learning_rate=0.05, num_leaves=31). All models used balanced sample weights.</p>
+<p><strong>SHAP Interpretability. </strong>SHAP TreeExplainer was applied to the selected best model to compute per-feature contribution values for each prediction. Stability was validated using Jaccard Similarity and Spearman Rank Correlation across five random subsets of 300 samples each.</p>
+<p><strong>LLM Integration. </strong>GPT-4o-mini was integrated using a selective explanation approach: the LLM is called only once at the end of the pipeline after prediction and SHAP computation are complete. The top SHAP features, prediction label, and confidence score are passed as a structured prompt to generate a natural language explanation in Indonesian.</p>
+<p><strong>System Deployment. </strong>The complete pipeline was deployed as an interactive Streamlit dashboard on Hugging Face Spaces (https://huggingface.co/spaces/aisyahn/ids-dashboard) featuring Quick Preset, Basic Input, Advanced Input, SHAP visualization, and LLM narrative output.</p>
+<h2><strong>RESULTS AND DISCUSSION</strong></h2>
+<p><strong>Model Performance Comparison</strong></p>
+<p>All three models were evaluated on 566,149 test instances. Macro-average F1-score was used as the primary metric given class imbalance, following the recommendation of Maseer et al., (2021).</p>
+<p class="caption">Table 1 Model Performance Comparison</p>
+<div class="table-wrap"><table><tr><th>Metric</th><th>Random Forest</th><th>XGBoost</th><th>LightGBM</th><th>Best Model</th></tr><tr><td>Accuracy</td><td>0.99</td><td>1.00</td><td>1.00</td><td>LightGBM/XGBoost</td></tr><tr><td>Macro Precision</td><td>0.78</td><td>0.85</td><td>0.88</td><td>LightGBM</td></tr><tr><td>Macro Recall</td><td>0.91</td><td>0.96</td><td>0.95</td><td>XGBoost</td></tr><tr><td>Macro F1-Score</td><td>0.80</td><td>0.88</td><td>0.91</td><td>LightGBM</td></tr><tr><td>Weighted F1-Score</td><td>0.99</td><td>1.00</td><td>1.00</td><td>LightGBM/XGBoost</td></tr></table></div>
+<p class="caption">Figure 3 Performance Comparison of Random Forest, XGBoost, and LightGBM</p>
+<h2><figure class="figure"><img src="assets/figure-2.png" alt="Research figure"><figcaption>Research figure</figcaption></figure></h2>
+<p>LightGBM was selected as the primary model based on its highest Macro F1-score (0.91), best balance between precision (0.88) and recall (0.95) on minority classes, and computational efficiency through GOSS and EFB techniques. Random Forest struggled particularly on Bot (F1=0.18) and Web Attack classes, while LightGBM achieved F1=0.66 for Bot and 0.74 for Web Attack Brute Force, significant improvements. The persistent weakness on Web Attack classes (F1&lt;0.75 across all models) is attributed to high feature overlap between web attack traffic and benign flows at the network flow level, a limitation inherent to flow-based NIDS as noted by Sharafaldin et al., (2018).</p>
+<p><strong>SHAP Interpretability Analysis</strong></p>
+<p>SHAP stability was evaluated using Jaccard Similarity and Spearman Rank Correlation across five random subsets of the test set. DoS Hulk, PortScan, and Bot achieved perfect Jaccard Similarity of 1.000 (σ=0.000), while BENIGN achieved 0.867, above the ≥0.8 reliability threshold established by Airani et al., (2025) and Pawlicki, (2023). All classes achieved Spearman correlation above 0.995, confirming that feature importance rankings are highly stable and reliable across different sample subsets.</p>
+<p class="caption">Table 2 SHAP Stability Results (Top-5 Features, 5 Random Subsets)</p>
+<div class="table-wrap"><table><tr><th>Class</th><th>Jaccard Mean</th><th>Jaccard Std</th><th>Spearman Mean</th><th>Spearman Std</th></tr><tr><td>BENIGN</td><td>0.8667</td><td>0.1633</td><td>0.9953</td><td>0.0016</td></tr><tr><td>DoS Hulk</td><td>1.0000</td><td>0.0000</td><td>0.9970</td><td>0.0010</td></tr><tr><td>PortScan</td><td>1.0000</td><td>0.0000</td><td>0.9970</td><td>0.0006</td></tr><tr><td>Bot</td><td>1.0000</td><td>0.0000</td><td>0.9976</td><td>0.0007</td></tr></table></div>
+<p class="caption">Figure 4. SHAP Stability Analysis (Jaccard Similarity and Spearman Rank Correlation)</p>
+<h2><figure class="figure"><img src="assets/figure-1.png" alt="Research figure"><figcaption>Research figure</figcaption></figure></h2>
+<p>Mean Signed SHAP analysis revealed domain-consistent patterns across all classes. For BENIGN traffic, Init_Win_bytes_forward (+1.648) and Destination Port (+1.315) showed the highest positive contributions, reflecting normal TCP window negotiation and standard service port usage. For DoS Hulk, Fwd IAT Std dominated with +3.227, consistent with high inter-packet timing variation caused by flooding. PortScan was characterized by Flow IAT Min (+1.114) reflecting minimal probe intervals, while Bot traffic was identified primarily through Destination Port (+0.289), consistent with ARES botnet C2 communication to specific ports as documented by Sharafaldin et al., (2018).</p>
+<p><strong>LLM Narrative Evaluation</strong></p>
+<p>LLM narrative quality was evaluated using quantitative metrics adapted from Zytek et al., (2024) and qualitative rubric assessment. Table 3 presents quantitative results across four test scenarios.</p>
+<p class="caption">Table 3 Quantitative Evaluation of LLM Narratives per Scenario</p>
+<div class="table-wrap"><table><tr><th>Scenario</th><th>Confidence</th><th>Accuracy</th><th>Completeness</th><th>Fidelity</th><th>Fluency</th><th>Conciseness</th></tr><tr><td>BENIGN</td><td>99.99%</td><td>40%</td><td>100%</td><td>0.50</td><td>5</td><td>4</td></tr><tr><td>DoS Hulk</td><td>99.99%</td><td>60%</td><td>100%</td><td>1.00</td><td>5</td><td>5</td></tr><tr><td>PortScan</td><td>89.85%</td><td>60%</td><td>80%</td><td>N/A</td><td>4</td><td>4</td></tr><tr><td>Bot</td><td>99.13%</td><td>80%</td><td>100%</td><td>1.00</td><td>5</td><td>5</td></tr><tr><td>Average</td><td>-</td><td>60%</td><td>95%</td><td>-</td><td>4.75</td><td>4.50</td></tr></table></div>
+<p>Completeness reached 100% in three of four scenarios, with PortScan scoring 80% due to implicit rather than explicit feature references. Fidelity reached 1.00 for DoS Hulk and Bot, confirming that described feature directions matched SHAP signs. The PortScan scenario received N/A for Fidelity because no top-SHAP features were explicitly named in the narrative. Average Fluency (4.75/5) and Conciseness (4.50/5) indicate consistently readable and well-structured narratives. Lower Accuracy on BENIGN (40%) reflects LLM tendency to select more intuitively interpretable features rather than strictly following SHAP ranking order, a characteristic of LLMs that optimize narrative comprehensibility over strict technical accuracy.</p>
+<p class="caption">Table 4 Qualitative Evaluation Results using Five-Criteria Rubric</p>
+<div class="table-wrap"><table><tr><th>Aspect</th><th>Criteria</th><th>Result</th></tr><tr><td>Information Clarity</td><td>Natural language without excessive technical jargon</td><td>✓ Met across all 4 scenarios</td></tr><tr><td>Contextual Appropriateness</td><td>Narrative consistent with SHAP values and predicted attack type</td><td>✓ Met; Bot scenario specifically mentions port 8080 consistent with ARES botnet pattern</td></tr><tr><td>Completeness</td><td>Covers label, confidence, key features, direction, action recommendation</td><td>✓ Met in 3/4; PortScan 80% due to implicit feature references</td></tr><tr><td>Action Recommendation</td><td>Specific and relevant recommendation per attack type</td><td>✓ Met; concrete actions: IP blocking (DoS), traffic isolation (Bot), log monitoring (PortScan)</td></tr><tr><td>SHAP Direction Consistency</td><td>Feature contribution direction reflected in narrative</td><td>✓ Met; attack features described as suspicious indicators, BENIGN features as normal patterns</td></tr></table></div>
+<p>The selective explanation approach demonstrated clear efficiency advantages. Unlike Khediri et al., (2024) who invoke the LLM for every prediction output, and Houssel et al., (2026) who apply LLM to every case in eX-NIDS, this approach calls the LLM only once at the end of the pipeline per analysis session. This design fundamentally reduces API call overhead while maintaining explanation quality comparable to full-pipeline approaches. The comparative evaluation (Table 5) confirms that SHAP+LLM integration substantially surpasses SHAP-only output across all interpretability dimensions.</p>
+<p class="caption">Table 5 Comparative Evaluation: SHAP Only vs. SHAP + LLM</p>
+<div class="table-wrap"><table><tr><th>Evaluation Aspect</th><th>SHAP Only</th><th>SHAP + LLM</th></tr><tr><td>Information Clarity</td><td>Numeric values and charts; hard to read for non-technical users</td><td>Clear, contextual Indonesian narrative</td></tr><tr><td>Contextual Appropriateness</td><td>Reflects feature contributions mathematically</td><td>Narrative tailored to detected attack type</td></tr><tr><td>Action Recommendation</td><td>Not available</td><td>Available and specific per attack type</td></tr><tr><td>Computational Efficiency</td><td>More efficient (no API call)</td><td>Efficient; LLM called once at pipeline end</td></tr><tr><td>Non-technical Accessibility</td><td>Low; requires SHAP expertise</td><td>High; narrative directly understandable by analysts</td></tr></table></div>
+<h2><strong>CONCLUSION AND RECOMMENDATION</strong></h2>
+<p>This study successfully developed an interpretable machine learning-based IDS on the CIC-IDS-2017 dataset integrating SHAP TreeExplainer and GPT-4o-mini LLM through a selective explanation approach. LightGBM achieved the highest Macro F1-score of 0.91, outperforming XGBoost (0.88) and Random Forest (0.80), consistent with Maseer et al., (2021) finding that boosting ensembles consistently outperform on CICIDS2017. SHAP stability analysis confirmed explanation reliability with Jaccard Similarity reaching 1.000 for three attack classes. LLM narrative evaluation demonstrated average Completeness of 95%, Fidelity of 1.00 on two scenarios (DoS Hulk and Bot), Fluency of 4.75/5, and Conciseness of 4.50/5, with all five qualitative rubric criteria met across test scenarios. Dashboard usability evaluation confirmed all six checklist aspects fulfilled. Hypothesis H1 is accepted: SHAP+LLM integration produces explanations with significantly higher clarity and relevance than SHAP output alone.</p>
+<p>Future research directions include: (1) exploring hybrid flow-based and payload-level features to improve Web Attack detection (currently F1&lt;0.75); (2) conducting structured expert evaluations and user studies with non-technical security analysts; (3) testing on more recent datasets to assess generalization to contemporary attack patterns; (4) exploring real-time streaming architectures using Apache Kafka for near-real-time detection; and (5) investigating local LLM deployment using models such as LLaMA or Mistral to eliminate external API dependencies and improve data privacy.</p>
+<h2><strong>REFERENCES</strong></h2>
+<p>Airani, S. S., Sinha, S., Bhat, S. R., &amp; K, D. (2025). Stability and Consistency Analysis of SHAP and LIME Explanations Across Machine Learning Models. <em>2025 5th International Conference on Emerging Research in Electronics, Computer Science and Technology (ICERECT)</em>, 1–6. https://doi.org/10.1109/ICERECT65215.2025.11378102</p>
+<p>Houssel, P. R. B., Layeghy, S., Singh, P., &amp; Portmann, M. (2026). eX-NIDS: A framework for explainable network intrusion detection leveraging Large Language Models. <em>Computers and Electrical Engineering</em>, <em>129</em>, 110826. https://doi.org/10.1016/j.compeleceng.2025.110826</p>
+<p>IBM. (2025). <em>Cost of a Data Breach Report 2025</em>. https://www.ibm.com/reports/data-breach</p>
+<p>Khediri, A., Slimi, H., Yahiaoui, A., Derdour, M., Bendjenna, H., &amp; Ghenai, C. E. (2024). Enhancing Machine Learning Model Interpretability in Intrusion Detection Systems through SHAP Explanations and LLM-Generated Descriptions. <em>2024 6th International Conference on Pattern Analysis and Intelligent Systems (PAIS)</em>, 1–6. https://doi.org/10.1109/PAIS62114.2024.10541168</p>
+<p>Maseer, Z. K., Yusof, R., Bahaman, N., Mostafa, S. A., &amp; Foozy, C. F. M. (2021). Benchmarking of Machine Learning for Anomaly Based Intrusion Detection Systems in the CICIDS2017 Dataset. <em>IEEE Access</em>, <em>9</em>, 22351–22370. https://doi.org/10.1109/ACCESS.2021.3056614</p>
+<p>Naudot, F., Sundqvist, T., &amp; Kampik, T. (2025). <em>llmSHAP: A Principled Approach to LLM Explainability</em> (arXiv:2511.01311). arXiv. https://doi.org/10.48550/arXiv.2511.01311</p>
+<p>Pawlicki, M. (2023). Towards Quality Measures for xAI algorithms: Explanation Stability. <em>2023 IEEE 10th International Conference on Data Science and Advanced Analytics (DSAA)</em>, 1–10. https://doi.org/10.1109/DSAA60987.2023.10302535</p>
+<p>Salih, A. M., Raisi-Estabragh, Z., Galazzo, I. B., Radeva, P., Petersen, S. E., Lekadir, K., &amp; Menegaz, G. (2025). A Perspective on Explainable Artificial Intelligence Methods: SHAP and LIME. <em>Advanced Intelligent Systems</em>, <em>7</em>(1), 2400304. https://doi.org/10.1002/aisy.202400304</p>
+<p>Sharafaldin, I., Habibi Lashkari, A., &amp; Ghorbani, A. A. (2018). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization: <em>Proceedings of the 4th International Conference on Information Systems Security and Privacy</em>, 108–116. https://doi.org/10.5220/0006639801080116</p>
+<p>Zeng, X., &amp; Zhu, K. (2026). <em>Enhancing the Interpretability of SHAP Values Using Large Language Models</em> (arXiv:2409.00079). arXiv. https://doi.org/10.48550/arXiv.2409.00079</p>
+<p>Zytek, A., Pido, S., Alnegheimish, S., Berti-Équille, L., &amp; Veeramachaneni, K. (2024). Explingo: Explaining AI Predictions using Large Language Models. <em>2024 IEEE International Conference on Big Data (BigData)</em>, 1197–1208. https://doi.org/10.1109/BigData62323.2024.10825114</p>
+<h2><strong>AUTHOR BIOGRAPHY</strong></h2>
+<p>Aisyah Nabillah is a Computer Science student at BINUS Online, Universitas Bina Nusantara, Jakarta. Her research interests include machine learning, cybersecurity, and explainable artificial intelligence.</p>
+  </main>
+  <footer>© Aisyah Nabillah · Research paper</footer>
+</body>
+</html>

style.css

@@ -0,0 +1,26 @@
+*{box-sizing:border-box}
+:root{--ink:#18212f;--muted:#64748b;--line:#e5eaf0;--accent:#315c83;--paper:#fff;--bg:#f3f6f9}
+html{scroll-behavior:smooth}
+body{margin:0;background:var(--bg);color:var(--ink);font:16px/1.75 Georgia,"Times New Roman",serif}
+.hero{max-width:980px;margin:44px auto 24px;padding:48px 56px 40px;background:#10283f;color:#fff;border-radius:18px}
+.eyebrow{font:700 11px/1.4 system-ui,sans-serif;letter-spacing:.16em;text-transform:uppercase;color:#a9c7e1;margin-bottom:22px}
+h1{font:700 clamp(30px,4.2vw,48px)/1.12 system-ui,sans-serif;letter-spacing:-.035em;margin:0 0 24px;max-width:850px}
+.author{font:600 18px system-ui,sans-serif;margin:0 0 5px}
+.affiliation,.email{font:14px/1.6 system-ui,sans-serif;color:#d5e1ec;margin:4px 0}
+.email{color:#9ed2f3;text-decoration:none}
+.paper{max-width:980px;margin:0 auto 48px;padding:48px 64px;background:var(--paper);border:1px solid var(--line);border-radius:16px;box-shadow:0 12px 40px #20354a0b}
+h2{font:700 22px/1.3 system-ui,sans-serif;letter-spacing:-.02em;margin:42px 0 14px;padding-bottom:10px;border-bottom:1px solid var(--line);color:#163b5a}
+h2:first-child{margin-top:0}
+p{margin:0 0 16px;text-align:justify}
+.meta-line{font:14px/1.65 system-ui,sans-serif;color:var(--muted);text-align:left;margin:12px 0}
+.caption{text-align:center;font:italic 13px/1.5 system-ui,sans-serif;color:var(--muted);margin:8px 0 20px}
+.figure{margin:24px auto;text-align:center}
+.figure img{max-width:100%;height:auto;max-height:620px;object-fit:contain;border:1px solid var(--line);border-radius:8px}
+.figure figcaption{font:12px system-ui,sans-serif;color:var(--muted);margin-top:6px}
+.table-wrap{overflow-x:auto;margin:18px 0 26px}
+table{width:100%;border-collapse:collapse;font:13px/1.5 system-ui,sans-serif}
+th,td{border:1px solid #cbd5e1;padding:9px 10px;text-align:left;vertical-align:top}
+th{background:#edf3f8;font-weight:700}
+tr:nth-child(even) td{background:#fafcfe}
+footer{text-align:center;color:var(--muted);font:12px system-ui,sans-serif;padding:8px 20px 36px}
+@media(max-width:700px){.hero{margin:0;padding:36px 24px 32px;border-radius:0}.paper{margin:0;padding:30px 22px;border-radius:0;border-left:0;border-right:0}body{font-size:15px}h2{font-size:19px}p{text-align:left}table{font-size:12px}}