💻 computer science

A Calibrated and Explainable Bimodal Machine Learning Framework for Hybrid Intrusion Detection

This paper proposes a calibrated and explainable bimodal machine learning framework that addresses data imbalance and black-box limitations in network security by combining security-oriented feature extraction, hybrid resampling, and SHAP-based analysis to achieve high precision on known attacks while effectively detecting unknown threats with minimal false positives.

Original authors: Hafsa Aslam, Yue Li, Saba Aslam, Gracious Mwamughunda

Published 2026-08-18

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hafsa Aslam, Yue Li, Saba Aslam, Gracious Mwamughunda

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the invisible highways of the internet, data flows constantly between computers, servers, and devices. This traffic is usually harmless, but it can also carry hidden threats: malicious code designed to steal information, crash systems, or hijack networks. To protect these digital pathways, security experts use Intrusion Detection Systems, which act like automated guards watching for suspicious activity. For decades, these guards have relied on two main strategies. The first is like a police officer checking a list of known criminals; it looks for specific patterns that match past attacks. This works well for familiar threats but fails completely against new, unknown dangers. The second strategy is like a guard watching for anyone acting strangely; it flags anything that does not look like normal behavior. While this can catch new threats, it often raises false alarms, shouting "danger" when a user is simply doing something unusual but harmless. The challenge for modern security is to build a system that is sharp enough to recognize known criminals, sensitive enough to spot new ones, and clear enough to explain exactly why it made a decision, all without being overwhelmed by the sheer volume of data.

A team of researchers at Donghua University and the Chinese Academy of Sciences has developed a new approach to solve this problem. They created a machine learning framework that combines the strengths of both known-pattern detection and anomaly spotting into a single, unified system. Instead of relying on complex, deep-learning models that act like black boxes, their method uses a more transparent type of algorithm called a Random Forest. This system is designed to handle a specific, difficult reality of network traffic: the data is wildly unbalanced. In a typical network, harmless traffic makes up the vast majority of what is seen, while dangerous attacks are extremely rare. This imbalance often tricks computer models into ignoring the rare attacks entirely. The researchers addressed this by carefully adjusting the training data to give rare threats more weight, ensuring the system learns to recognize them. They also introduced a method to calibrate the system's confidence, meaning the computer can tell security analysts how sure it is about a threat, rather than just guessing.

The core of their work is a "bimodal" framework, which means it operates with two distinct but connected modes of thinking. The first mode acts as a specialist in known attacks. It has been trained to recognize specific types of threats, such as denial-of-service attacks or web-based intrusions, with high precision. The second mode acts as a generalist, scanning for anything that deviates from normal behavior, which allows it to catch entirely new types of attacks that have never been seen before. These two modes work together without needing to be retrained separately. When the system processes a stream of network data, it transforms raw information into meaningful security features, such as how long a connection lasts or whether the traffic is coming from a web server. It then runs this information through both modes simultaneously. If the first mode recognizes a specific attack, it identifies it by name. If the second mode senses something strange but cannot name it, it flags it as a potential unknown threat.

To ensure the system is trustworthy, the researchers added a layer of explainability. Many advanced computer models make decisions that humans cannot understand, which makes security analysts hesitant to trust them. This new framework uses a technique called SHAP analysis to trace every decision back to the specific features that caused it. For example, if the system flags a connection as dangerous, it can show that the decision was driven by a specific pattern in the packet size or the duration of the flow, rather than a random error. The researchers tested their system on a large, real-world dataset of network traffic containing various types of attacks. They found that the system achieved a high level of accuracy in identifying known attacks, with a performance score of 0.8626 on a scale where higher is better. More importantly, it proved capable of detecting unknown threats. When tested against attacks it had never seen before, the system correctly identified them in up to 90.17 percent of cases for certain types of slow-moving attacks, while keeping false alarms to a minimum.

The study also highlighted the importance of how the data is prepared. The researchers found that simply feeding raw data into a model was not enough; they had to use a hybrid resampling strategy to balance the numbers. This involved reducing the overwhelming amount of normal traffic data and artificially increasing the representation of rare attack types so the model could learn from them. They also adjusted the system's sensitivity thresholds, lowering the bar for detecting specific, hard-to-catch web attacks like cross-site scripting. This adjustment allowed the system to catch more of these rare threats without generating too many false alarms. The results showed that the system could detect these rare attacks with a success rate of 77.04 percent, a significant improvement over previous methods that often missed them entirely.

When compared to other recent studies, this framework stood out for its ability to handle both known and unknown threats without the heavy computational cost of deep learning. Other approaches either struggled with unknown attacks or required so much computing power that they were difficult to use in real-time. This new method offers a balanced solution that is both powerful and practical. The researchers confirmed that the system's decisions were driven by security-relevant features, such as the duration of a connection or the number of packets sent, rather than by confusing artifacts in the data. This means that when the system raises an alert, security teams can trust that it is based on genuine signs of an attack. By bridging the gap between theoretical models and real-world security needs, this work provides a clearer, more reliable way to protect digital networks from both familiar and emerging dangers.

Technical Summary: A Calibrated and Explainable Bimodal Machine Learning Framework for Hybrid Intrusion Detection

1. Problem Statement

Modern communication systems face critical vulnerabilities in Intrusion Detection Systems (IDS) due to three primary limitations in existing approaches:

Closed-World Assumptions: Traditional signature-based systems (e.g., Snort) fail against zero-day threats, while standard anomaly-based models often suffer from high false positive rates and alert fatigue.
Data Imbalance and Calibration Issues: Network traffic datasets, such as CIC-IDS2017, exhibit extreme class imbalance (e.g., benign traffic comprising ~93.6% of samples, while rare attacks like Web-XSS are <0.06%). This imbalance renders rare attacks statistically invisible to standard models. Furthermore, many ML models produce poorly calibrated confidence scores, making thresholding unsafe for critical, low-volume threats.
Lack of Actionable Explainability: Existing explainability methods often rely on low-level packet features rather than security-grounded descriptors, reducing their forensic value and analyst trust.

The authors argue that current solutions either lack the ability to detect unknown attacks (open-set generalization) or fail to provide calibrated, interpretable decisions without the computational complexity of deep learning.

2. Methodology

The proposed solution is a bimodal Random Forest (RF) framework that unifies signature-based classification for known attacks with anomaly-aware detection for unknown threats. The methodology consists of the following stages:

A. Data Preprocessing and Feature Engineering

Dataset: The framework is evaluated on the CIC-IDS2017 dataset.
Cleaning: Missing or infinite values are imputed using median substitution. Labels are normalized to ensure consistency.
Feature Extraction: Two security-oriented features are engineered to enhance the signal-to-noise ratio:
1. Flow Duration: Critical for detecting low-and-slow attacks (e.g., Slowloris).
2. Is_Web_Traffic: A binary flag isolating application-layer threats via HTTP/HTTPS ports.
Pruning: Low-variance ( $\sigma < 0.02$ ) and highly redundant features ( $\rho > 0.8$ ) are removed, resulting in 78 robust features.

B. Hybrid Resampling Strategy

To address the extreme imbalance (~14,652:1) without distorting feature distributions, a three-phase hybrid resampling approach is employed:

Majority Undersampling: Reduces the dominant benign class size.
ADASYN Oversampling: Generates synthetic samples for mid-rare classes ( $100 \le n_k \le 5000$ ) based on local density.
Manual Boosting: Randomly duplicates samples for ultra-rare classes ( $n_k < 100$ ) to ensure representation.
This reduces the imbalance ratio to approximately 99:1.

C. The Bimodal Architecture

The core innovation is a dual-path Random Forest structure:

Mode 1 (Signature-Based Multiclass RF): Trained on the balanced dataset to identify specific attack types ( $K=7$ ). It utilizes isotonic regression for probability calibration to ensure reliable confidence scores. For rare classes (e.g., Web-XSS), adaptive thresholding ( $\tau=0.30$ ) is applied to improve recall without degrading overall accuracy.
Mode 2 (Anomaly-Aware Binary RF): Operates in open-set mode, classifying traffic as either "Benign" or "Anomalous" (any non-benign). This path flags deviations from normal behavior to detect unknown threat families.

D. Calibration and Explainability

Calibration: Isotonic regression is applied to both paths to correct tree-ensemble miscalibration, enabling safe adaptive thresholding.
Explainability: SHAP (SHapley Additive exPlanations) is used to validate that model decisions are driven by security-relevant features (e.g., Flow Duration, DDoS_Score) rather than model artifacts or low-level protocol flags.

3. Key Results

Evaluated on the CIC-IDS2017 dataset, the framework demonstrates the following performance:

Known Attack Detection: The calibrated multiclass RF achieves a Macro F1 score of 0.8626 and a weighted F1 of 0.98. Volumetric attacks (e.g., DoS Hulk) show precision and recall >0.99.
Open-Set Detection (Unknown Threats): When entire attack families are held out as unknown:
- DoS Slowloris: Achieves a True Positive Rate (TPR) of 90.17% at a 1% False Positive Rate (FPR).
- Web Attack - XSS: Achieves a TPR of 77.04% at 1% FPR.
- FTP-Patator: Achieves a TPR of 94% at 1% FPR.
- The binary anomaly detector achieves near-perfect separation (TPR = 99.82%, FPR = 0.06%).
Resampling Impact: The hybrid resampling strategy improved the representation of ultra-rare classes (e.g., "Other_Attacks" increased by 1,407%), restoring semantic structure and enabling the learning of rare-attack patterns.
Explainability: SHAP analysis confirmed that decisions are driven by high-level behavioral semantics (e.g., packet length statistics, flow duration) rather than low-level flags (e.g., URG, ECE), which contributed minimally (<10% of impact).

4. Significance and Claims

The paper claims to bridge the gap between theoretical ML models and operational IDS requirements by delivering a system that is:

Unified: It resolves the integration challenge between known-attack precision and unknown-attack generalization within a single framework without requiring dual-model retraining.
Calibrated: It provides trustworthy confidence scores, allowing for safe threshold adjustments for rare threats (e.g., lowering the threshold for XSS to $\tau=0.30$ ) while maintaining low false positive rates.
Explainable: It ensures that detection logic is grounded in security-relevant features, providing analysts with forensically actionable insights rather than opaque "black-box" decisions.
Efficient: It achieves high performance without the computational overhead and interpretability limitations associated with deep learning models (e.g., CNN-LSTM).

The authors position this work as a reproducible framework that moves beyond standard supervised or unsupervised baselines, which often fail under extreme imbalance and zero-day conditions. While the study is validated on a single dataset (CIC-IDS2017) for comparability, the authors assert the framework is dataset-agnostic and adaptable to other benchmarks.