The DOI matches its Crossref record; 15 of the 15 references it cites were found in a registry or an index.
A Hybrid Deep Learning Approach to Network Traffic Anomaly Detection Enhanced by SHAP and LIME Interpretability
Abstract
The increasing complexity and volume of network traffic have made anomaly detection a critical challenge in cybersecurity. Traditional methods often struggle to balance accuracy and interpretability, this limits their efficacy in real-world applications. This study looks toward the improvement of anomalies. detection in network traffic by integrating SHAP and LIME interpretability techniques into hybrid deep learning models. The primary goal is to improve both the detection performance and the interpretability of these models, enabling security analysts to understand. The project's goal is to improve cybersecurity operations' usability and trust by offering clear and practical insights into the model's predictions. The hybrid deep learning model includes CNNs for spatial feature extraction with RNN for temporal pattern analysis, taking use of the capabilities of both architectures to better detect abnormalities. One of the main tactics used in this study is the preparation and feature extraction of network traffic data,developing,training a hybrid deep learning model for anomaly detection and integrating SHAP and LIME to comprehend the model's predictions. The dataset used for evaluation includes real-world network traffic with labelled anomalies, ensuring the relevance and applicability of the results. The model's detection abilities were tested using performance metrics such as accuracy, precision, recall and F1-score. The result's interpretability was assessed by qualitati…
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Similarly, Verma and Prabakeran (2025) introduced a hybrid approach that integrates LIME explanations with optimized feature selection to improve transparency in cyberattack classification.”
From Explainable AI: enhancing decision-making in the detection of cyber threats (2026) · cites this paper as Verma and Prabakeran (2025)
Citations
Cites
Survey on SDN based network intrusion detection system using machine learning approaches
Sultana, N., Chilamkurti, N., Peng, W., & Alhadad, R. (2018) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-017-0630-0 · Cited by 543
A Survey and a Layered Taxonomy of Software-Defined Networking
Jarraya, Y., Madi, T., & Debbabi, M. (2014) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2014.2320094 · Cited by 372
Design and Development of RNN Anomaly Detection Model for IoT Networks
Ullah, I., & Mahmoud, Q. H. (2022) · IEEE Access · doi:10.1109/access.2022.3176317 · Cited by 309
Improving Performance of Autoencoder-Based Network Anomaly Detection on NSL-KDD Dataset
Xu, W. L., Jang‐Jaccard, J., Singh, A. S. G., Wei, Y., & Sabrina, F. (2021) · IEEE Access · doi:10.1109/access.2021.3116612 · Cited by 262
Said, R. B., Sabir, Z., & Askerzade, I. N. (2023) · IEEE Access · doi:10.1109/access.2023.3340142 · Cited by 154
Musa, N. S., Mirza, N. M., Rafique, S. H., Abdallah, A. M., & Thangavel, M. (2024) · IEEE Access · doi:10.1109/access.2024.3360868 · Cited by 95
A Comparative Study of Using Deep Learning Algorithms in Network Intrusion Detection
Elsayed, S., Mohamed, K., & Madkour, M. A. (2024) · IEEE Access · doi:10.1109/access.2024.3389096 · Cited by 77
An efficient flow-based multi-level hybrid intrusion detection system for software-defined networks
Latah, M., & Toker, L. (2020) · CCF Transactions on Networking · doi:10.1007/s42045-020-00040-z · Cited by 71
Lifelong Continual Learning for Anomaly Detection: New Challenges, Perspectives, and Insights
Faber, K., Corizzo, R., Śnieżyński, B., & Japkowicz, N. (2024) · IEEE Access · doi:10.1109/access.2024.3377690 · Cited by 54
Enhancing Urban Traffic Management Through Real-Time Anomaly Detection and Load Balancing
Laanaoui, M. D., Lachgar, M., Hanine, M., Hrimech, H., Villar, S. G., & Ashraf, I. (2024) · IEEE Access · doi:10.1109/access.2024.3393981 · Cited by 42
Cited by
Sorted by citations
Paolini, D., Dini, P., Elhanashi, A., & Saponara, S. (2026) · Electronics · doi:10.3390/electronics15020476 · Cited by 30
Explainable AI: enhancing decision-making in the detection of cyber threats
Prasad, P. W. C., Sayeed, M. S., Nguyen, D.-M., Hutabarat, D. P., & Mohiuddin, G. M. (2026) · Frontiers in Computer Science · doi:10.3389/fcomp.2026.1762332 · Cited by 16
Ahmed, U., Muhammad, S., & Choi, J. (2026) · Sensors · doi:10.3390/s26144540 · Cited by 1
Evaluation of Hybrid and GPU-Optimized Explainability Methods for Tree-Based Model
Jegan, R. K., Baskaran, S., Gurupriya, M., & Gayathri, R. (2025) · Asian Conference on Intelligent Technologies (ACOIT) · doi:10.1109/acoit66109.2025.11436541
LIME-Enhanced Insider Threat Detection for Distributed Security Systems
Faqihi, R., Nanda, P., Mohanty, M., Alqahtani, S., & Alrashed, B. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-8408-6_18
Metadata
- Authors
- Verma, S., & Prabakeran, S.
- Affiliations
- SRM Institute of Science and Technology (IN)
- ORCID
- Prabakeran, S.
- Venue
- 2025 8th International Conference on Trends in Electronics and Informatics (ICOEI)
- Publisher
- IEEE
- Published
- 2025-04-24
- Pages
- 1254-1261
- OpenAlex
- W4410887714
- Cited by
- 11
- References
- 15
- Citations by year
- 2026: 9 · 2025: 2
- FWCI
- 13.71
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International Conference on Trends in Electronics and Informatics (ICOEI) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- network traffic anomaly detection, SHAP, lime, model interpretability, hybrid deep learning model, CNN-RNN, explainable AI, cybersecurity, false alarm reduction, network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
