Explainable Artificial Intelligence-Based Intrusion Detection for Zero-Day Cyber Attacks: A Hybrid Transformer–Long Short-Term Memory Framework with SHapley Additive exPlanations and Local Interpretable Model-Agnostic Explanations Interpretability

Abstract

The escalating frequency of zero-day cyber-attacks, defined as exploits that target previously undisclosed software vulnerabilities, has outpaced the capability of signature-based and conventional supervised Intrusion Detection Systems (IDS) to respond in a timely and trustworthy manner. Deep learning models have improved raw detection accuracy for novel attack patterns, but their opaque, black-box decision processes undermine analyst trust, complicate forensic accountability, and slow incident response in Security Operations Centres (SOCs). This study proposes and empirically evaluates a hybrid Explainable Artificial Intelligence (XAI)-based Intrusion Detection framework that combines an unsupervised auto encoder for anomaly and novelty scoring with a supervised Transformer–LSTM classifier for known-attack discrimination, coupled with an open-set recognition layer for zero-day flagging. Post-hoc interpretability is furnished through SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME), generating both global feature-importance rankings and per-alert, analyst-facing rationales. The framework was trained and evaluated on three benchmark datasets (CICIDS2017, NSL-KDD, and UNSW-NB15) under a leave-one-attack-family-out protocol that simulates genuine zero-day conditions by withholding entire attack categories from training. Experimental results show that the proposed hybrid model attained 97.8% accuracy, 97.2% precision, 96.9% recall, 97.0% F1-score, and an area-under-curve (AUC) of 0.986 on unseen attack categories, outperforming standalone CNN, LSTM, Random Forest, and SVM baselines by margins of 3.7 to 9.4 percentage points in F1-score. SHAP analysis identified flow duration, destination-port entropy, and packet inter-arrival variance as the dominant discriminative features across attack families, while LIME-generated local explanations demonstrated high fidelity (mean fidelity score of 0.91) to the underlying model behaviour. The findings indicate that embedding explainability directly into the zero-day detection pipeline, rather than treating it as an auxiliary diagnostic layer, materially improves both detection robustness and analyst-facing transparency without incurring prohibitive computational overhead. The paper concludes with recommendations for operational deployment, dataset diversification, and future integration of causal and counterfactual explanation methods.