Explainable and Scalable Deep Learning Framework for Zero-Day Cyber Attack Detection in High-Dimensional Network Traffic

Abstract

The rapid evolution of network-based cyber threats particularly zero-day attacks presents fundamental challenges to intrusion detection systems (IDS). Existing deep learning approaches frequently sacrifice explainability and scalability, two properties essential for operational deployment. This paper presents EXSCAD (EXplainable and SCAlable Detection), a deep learning framework that integrates contrastive self-supervised pretraining, mutual-information-guided feature selection, supervised fine-tuning with open-set thresholding, and a KernelSHAP explainability layer for zero-day attack detection in high-dimensional network traffic. Evaluated on the CICIDS2018 and UNSW-NB15 benchmarks (~18.77 million flow records), EXSCAD achieves an F1-score of 98.07 ± 0.17% and zero-day recall of 87.34 ± 2.41%, statistically outperforming Random Forest , XGBoost, BiLSTM-IDS , CNN-IDS, and autoencoder baselines  (Wilcoxon signed-rank, p < 0.0001). Ablation studies confirm that contrastive pretraining is the primary driver of zero-day generalisation. Inference latency of 39.2 ms per 1,000 samples supports real-time SOC deployment.