CoChat
Sign Up
PreprintCited by 12Network Security and Intrusion DetectionNetwork Packet Processing and OptimizationAdversarial Robustness in Machine Learning

The DOI matches its DataCite record.

LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity

Open access
Yagiz, Muhammet Anil, Goktas, Polat·2025·arXiv
DOI 10.48550/arxiv.2501.00790arXiv 2501.00790
Open this paper in CoChat — free accountOpen PDF

Abstract

The rapid proliferation of Industrial Internet of Things (IIoT) systems necessitates advanced, interpretable, and scalable intrusion detection systems (IDS) to combat emerging cyber threats. Traditional IDS face challenges such as high computational demands, limited explainability, and inflexibility against evolving attack patterns. To address these limitations, this study introduces the Lightweight Explainable Network Security framework (LENS-XAI), which combines robust intrusion detection with enhanced interpretability and scalability. LENS-XAI integrates knowledge distillation, variational autoencoder models, and attribution-based explainability techniques to achieve high detection accuracy and transparency in decision-making. By leveraging a training set comprising 10% of the available data, the framework optimizes computational efficiency without sacrificing performance. Experimental evaluation on four benchmark datasets: Edge-IIoTset, UKM-IDS20, CTU-13, and NSL-KDD, demonstrates the framework's superior performance, achieving detection accuracies of 95.34%, 99.92%, 98.42%, and 99.34%, respectively. Additionally, the framework excels in reducing false positives and adapting to complex attack scenarios, outperforming existing state-of-the-art methods. Key strengths of LENS-XAI include its lightweight design, suitable for resource-constrained environments, and its scalability across diverse IIoT and cybersecurity contexts. Moreover, the explainability module enhances trust and transparency, critical for practical deployment in dynamic and sensitive applications. This research contributes significantly to advancing IDS by addressing computational efficiency, feature interpretability, and real-world applicability. Future work could focus on extending the framework to ensemble AI systems for distributed environments, further enhancing its robustness and adaptability.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2501.00790

Cites

Statistics

Figures

Figure 1 Class distribution of Edge-IIoTset dataset.
Figure 1 Class distribution of Edge-IIoTset dataset.CC-BY · From the PDF
Image 2
CC-BY · From the PDF
Figure 3 Class distribution of NSL-KDD dataset.
Figure 3 Class distribution of NSL-KDD dataset.CC-BY · From the PDF
Figure 4 Confusion matrices of the LENS-XAI framework on the Edge-IIoTSet dataset: (Left) Teacher and (Right) Student models, showcasing effective differentiation between 15 classes.
Figure 4 Confusion matrices of the LENS-XAI framework on the Edge-IIoTSet dataset: (Left) Teacher and (Right) Student models, showcasing effective differentiation between 15 classes.CC-BY · From the PDF
Figure 5 Confusion matrices of the LENS-XAI framework on the UKM IDS20 dataset: (Left) Teacher and (Right) Student models, showcasing effective differentiation between eight classes.
Figure 5 Confusion matrices of the LENS-XAI framework on the UKM IDS20 dataset: (Left) Teacher and (Right) Student models, showcasing effective differentiation between eight classes.CC-BY · From the PDF
Image 6
CC-BY · From the PDF
Figure 7 Confusion matrices of the LENS-XAI framework on the NSL-KDD dataset: (Left) Teacher and (Right) Student models, showcasing effective differentiation between five classes.
Figure 7 Confusion matrices of the LENS-XAI framework on the NSL-KDD dataset: (Left) Teacher and (Right) Student models, showcasing effective differentiation between five classes.CC-BY · From the PDF
Figure 8 Variable attribution-based explainability results for the CTU-13 dataset, highlighting key feature contributions for (Left) Teacher and (Right) Student models.
Figure 8 Variable attribution-based explainability results for the CTU-13 dataset, highlighting key feature contributions for (Left) Teacher and (Right) Student models.CC-BY · From the PDF
Figure 9 Variable attribution-based explainability results for the UKM20 dataset (binary classification), highlighting key feature contributions for (Left) Teacher and (Right) Student models.
Figure 9 Variable attribution-based explainability results for the UKM20 dataset (binary classification), highlighting key feature contributions for (Left) Teacher and (Right) Student models.CC-BY · From the PDF

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

No references could be resolved yet.

Research works printed but not linked: 49

  1. I. Alrashdi, K. M. Sallam, M. A. Alrowaily, O. Alruwaili, B. Arain, Fidwatch: Federated incremental distillation for continuous monitoring of iot security threats, Ad Hoc Networks 165 (2024) 103637. doi:10. 1016/j.adhoc.2024.103637. · DOI
  2. F. Ullah, S. Ullah, G. Srivastava, J. C.-W. Lin, Ids-int: Intrusion de- tection system using transformer-based transfer learning for imbalanced network traffic, Digital Communications and Networks 10 (1) (2024) 190-204. doi:10.1016/j.dcan.2023.03.008. · DOI
  3. E. C. Nkoro, J. N. Njoku, C. I. Nwakanma, J.-M. Lee, D.-S. Kim, Zero- trust marine cyberdefense for iot-based communications: An explainable approach, Electronics (Switzerland) 13 (2) (2024) 276. doi:10.3390/ electronics13020276. · DOI
  4. K. Fatema, M. Anannya, S. K. Dey, C. Su, R. Mazumder, Securing networks: A deep learning approach with explainable ai (xai) and fed- erated learning for intrusion detection, in: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 15215 LNCS, 2025, pp. 260-275. doi:10.1007/978-981-97-8540-7_16. · DOI
  5. R. Kumar, A. Aljuhani, D. Javeed, P. Kumar, S. Islam, A. K. M. N. Islam, Blockchain and explainable ai for enhanced decision making in cyber threat detection, Software -Practice and Experience 54 (8) (2024) 1337-1360. doi:10.1002/spe.3319. · DOI · Paper page
  6. D. Javeed, T. Gao, P. Kumar, S. Shoukat, I. Ahmad, R. Kumar, An intelligent and interpretable intrusion detection system for unmanned aerial vehicles, in: IEEE International Conference on Communications, 2024, pp. 1951-1956. doi:10.1109/ICC51166.2024.10622703. · DOI
  7. S. Bellegdi, A. Selamat, S. O. Olatunji, H. Fujita, O. Krejcar, Explain- able machine learning for intrusion detection 14748 LNAI (2024) 122- 134. doi:10.1007/978-981-97-4677-4_11. · DOI
  8. D. Gaspar, P. Silva, C. Silva, Explainable ai for intrusion detection systems: Lime and shap applicability on multi-layer perceptron, IEEE Access 12 (2024) 30164-30175. doi:10.1109/ACCESS.2024.3368377. · DOI
  9. M. Nalini, B. Yamini, P. Sinthia, S. Praveena Rachel Kamala, Deep- roughnetid: A robust framework for network anomaly intrusion detec- tion with high detection rates, IETE Journal of Research 70 (9) (2024) 7137-7148. doi:10.1080/03772063.2024.2350932. · DOI
  10. S. Krishnaveni, S. Sivamohan, B. Jothi, T. M. Chen, M. Sathiya- narayanan, Twinsec-ids: An enhanced intrusion detection system in sdn-digital-twin-based industrial cyber-physical systems, Concurrency and Computation: Practice and Experience (2024). doi:10.1002/cpe. 8334. · DOI
  11. A. Alzu'bi, O. Darwish, A. Albashayreh, Y. Tashtoush, Cyberattack event logs classification using deep learning with semantic feature anal- ysis, Computers and Security 150 (2025) 104222. doi:10.1016/j.cose. 2024.104222. · DOI
  12. T. Walczyna, D. Jankowski, Z. Piotrowski, Enhancing anomaly de- tection through latent space manipulation in autoencoders: A com- parative analysis, Applied Sciences 15 (1) (2024) 286. doi:10.3390/ app15010286. · DOI
  13. M. AL-Essa, G. Andresini, A. Appice, D. Malerba, Panacea: A neural model ensemble for cyber-threat detection, Machine Learning 113 (8) (2024) 5379-5422. doi:10.1007/s10994-023-06470-2. · DOI
  14. Y. K. Saheed, J. E. Chukwuere, Xaiensembletl-iov: A new explainable artificial intelligence ensemble transfer learning for zero-day botnet at- tack detection in the internet of vehicles, Results in Engineering 24 (2024) 103171. doi:10.1016/j.rineng.2024.103171. · DOI
  15. S. R. Sindiramutty, C. E. Tan, S. P. Lau, R. Thangaveloo, A. H. Gharib, Explainable ai for cybersecurity, Advances in Explainable AI Applica- tions for Smart Cities (2024) 31-97.doi:10.4018/978-1-6684-6361-1. ch002. · DOI
  16. S. R. Alotaibi, H. K. Alkahtani, M. Aljebreen, A. Alshuhail, M. K. Saeed, S. A. Ebad, W. S. Almukadi, M. Alotaibi, Explainable artificial intelligence in web phishing classification on secure iot with cloud-based cyber-physical systems, Alexandria Engineering Journal 110 (2025) 490- 505. doi:10.1016/j.aej.2024.09.115. · DOI
  17. R. Zhao, Y. Chen, Y. Wang, Y. Shi, Z. Xue, An efficient and lightweight approach for intrusion detection based on knowledge distillation, in: Proceedings of the IEEE International Conference on Communications, 2021, pp. 1-8. doi:10.1109/ICC42927.2021.9500574. · DOI
  18. Y. Chen, S. Al-Rubaye, A. Tsourdos, L. Baker, C. Gillingham, Differentially-private federated intrusion detection via knowledge dis- tillation in third-party iot systems of smart airports, IEEE Interna- tional Conference on Communications 2023-May (2023) 603-608. doi: 10.1109/ICC45041.2023.10279722. · DOI
  19. M. Bacevicius, A. Paulauskaite-Taraseviciene, Machine learning algo- rithms for raw and unbalanced intrusion detection data in a multi-class classification problem, Applied Sciences (Switzerland) 13 (2023) 7328. doi:10.3390/app13127328. · DOI
  20. S. Roy, J. Li, V. Pandey, Y. Bai, An explainable deep neural frame- work for trustworthy network intrusion detection, in: Proceedings of the 2022 10th IEEE International Conference on Mobile Cloud Com- puting, Services, and Engineering (MobileCloud), 2022, pp. 25-30. doi:10.1109/MobileCloud55333.2022.00011. · DOI
  21. U. Ahmed, Z. Jiangbin, A. Almogren, S. Khan, M. T. Sadiq, A. Al- tameem, A. U. Rehman, Explainable ai-based innovative hybrid ensem- ble model for intrusion detection, Journal of Cloud Computing 13 (1) (2024) 150. doi:10.1186/s13677-024-00712-x. · DOI
  22. N. Moustafa, N. Koroniotis, M. Keshk, A. Y. Zomaya, Z. Tari, Explain- able intrusion detection for cyber defences in the internet of things: Op- portunities and solutions, IEEE Communications Surveys and Tutorials 25 (3) (2023) 1775-1807. doi:10.1109/COMST.2023.3280465. · DOI · Paper page
  23. M. A. Yagiz, P. MohajerAnsari, M. D. Pesé, P. Goktas, Transform- ing in-vehicle network intrusion detection: Vae-based knowledge dis- tillation meets explainable ai, in: Proceedings of the Sixth Workshop on CPS&IoT Security and Privacy, ACM, 2024, pp. 93-103. doi: 10.1145/3690134.3694819. · DOI
  24. T.-T.-H. Le, R. W. Wardhani, D. S. C. Putranto, U. Jo, H. Kim, To- ward enhanced attack detection and explanation in intrusion detection system-based iot environment data, IEEE Access 11 (2023) 131661- 131676. doi:10.1109/ACCESS.2023.3336678. · DOI
  25. N. Kostopoulos, D. Kalogeras, D. Pantazatos, M. Grammatikou, V. Maglaris, Shap interpretations of tree and neural network dns clas- sifiers for analyzing dga family characteristics, IEEE Access 11 (2023) 61144-61160. doi:10.1109/ACCESS.2023.3286313. · DOI
  26. M. M. Shtayat, M. K. Hasan, R. Sulaiman, S. Islam, A. U. R. Khan, An explainable ensemble deep learning approach for intrusion detection in industrial internet of things, IEEE Access 11 (2023) 115047-115061. doi:10.1109/ACCESS.2023.3323573. · DOI
  27. S. Sivamohan, S. Sridhar, S. Krishnaveni, Tea-ekho-ids: An intrusion detection system for industrial cps with trustworthy explainable ai and enhanced krill herd optimization, Peer-to-Peer Networking and Appli- cations 16 (4) (2023) 1993-2021. doi:10.1007/s12083-023-01507-8. · DOI
  28. A. Hattak, G. Iadarola, F. Martinelli, F. Mercaldo, A. Santone, A method for robust and explainable image-based network traffic clas- sification with deep learning, in: Proceedings of the International Conference on Security and Cryptography, 2023, pp. 385-393. doi: 10.5220/0012083200003555. · DOI
  29. S. Arisdakessian, O. A. Wahab, A. Mourad, H. Otrok, M. Guizani, A survey on iot intrusion detection: Federated learning, game theory, so- cial psychology, and explainable ai as future directions, IEEE Internet of Things Journal 10 (5) (2023) 4059-4092. doi:10.1109/JIOT.2022. 3203249. · DOI
  30. R. Kumar, A. Aljuhani, D. Javeed, P. Kumar, S. Islam, A. N. Islam, Dig- ital twins-enabled zero touch network: A smart contract and explainable ai integrated cybersecurity framework, Future Generation Computer Systems 156 (2024) 191-205. doi:10.1016/j.future.2024.02.015. · DOI
  31. D. P. Kingma, M. Welling, Auto-encoding variational bayes, in: Inter- national Conference on Learning Representations (ICLR), 2014. URL https://arxiv.org/abs/1312.6114 · arXiv
  32. G. Hinton, O. Vinyals, J. Dean, Distilling the knowledge in a neural net- work, in: NIPS Deep Learning and Representation Learning Workshop, Curran Associates, Inc., 2015. URL https://arxiv.org/abs/1503.02531 · arXiv
  33. A. Gosiewska, P. Biecek, ibreakdown: Uncertainty of model explana- tions for non-additive predictive models, arXiv (2019). URL https://arxiv.org/abs/1903.11420v1 · arXiv
  34. M. Robnik-Šikonja, I. Kononenko, Explaining classifications for individ- ual instances, IEEE Transactions on Knowledge and Data Engineering 20 (5) (2008) 589-600. doi:10.1109/tkde.2007.190734. · DOI
  35. P. Biecek, T. Burzykowski, Explore, Explain, and Examine Predictive Models: With Examples in R and Python, CRC Press, 2020.
  36. K. Yang, J. Wang, M. Li, An improved intrusion detection method for iiot using attention mechanisms, bigru, and inception-cnn, Scientific Re- ports 14 (1) (2024) 19339. doi:10.1038/s41598-024-70094-2. · DOI
  37. W. N. H. Ibrahim, S. Anuar, A. Selamat, O. Krejcar, R. G. Crespo, E. Herrera-Viedma, H. Fujita, Multilayer framework for botnet detec- tion using machine learning algorithms, IEEE Access: Practical Inno- vations, Open Solutions 9 (2021) 48753-48768. doi:10.1109/ACCESS. 2021.3060778. · DOI
  38. A. Sharma, H. Babbar, Detecting cyber threats in real-time: A super- vised learning perspective on the ctu-13 dataset, in: 2024 5th Inter- national Conference for Emerging Technology (INCET), 2024, pp. 1-5. doi:10.1109/INCET61516.2024.10593100. · DOI
  39. I. Letteri, G. Della Penna, P. Caianiello, Feature selection strategies for http botnet traffic detection, in: 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), IEEE, 2019, pp. 202- 210. doi:10.1109/EuroSPW.2019.00029. · DOI
  40. A. Pektaş, T. Acarman, Botnet detection based on network flow sum- mary and deep learning, International Journal of Network Management 28 (6) (Nov. 2018). doi:10.1002/nem.2039. · DOI
  41. S. Taheri, M. Salem, J. S. Yuan, Leveraging image representation of net- work traffic data and transfer learning in botnet detection, Big Data and Cognitive Computing 2 (4) (2018) 1-16. doi:10.3390/bdcc2040037. URL https://stars.library.ucf.edu/scopus2015/7328 · DOI
  42. M. Al-Qatf, Y. Lasheng, M. Al-Habib, K. Al-Sabahi, Deep learning approach combining sparse autoencoder with svm for network intrusion detection, IEEE Access 6 (2018) 52843-52856. doi:10.1109/ACCESS. 2018.2869577. · DOI
  43. B. Ingre, A. Yadav, Performance analysis of nsl-kdd dataset using ann, in: 2015 International Conference on Signal Processing and Commu- nication Engineering Systems, IEEE, 2015, pp. 92-96. doi:10.1109/ SPACES.2015.7058223. · DOI
  44. A. Javaid, Q. Niyaz, W. Sun, M. Alam, A deep learning approach for net- work intrusion detection system, in: Proceedings of the 9th EAI Inter- national Conference on Bio-inspired Information and Communications Technologies, 2016, pp. 21-26. doi:10.4108/eai.3-12-2015.2262516. · DOI
  45. R. Vinayakumar, M. Alazab, K. P. Soman, P. Poornachandran, A. Al- Nemrat, S. Venkatraman, Deep learning approach for intelligent in- trusion detection system, IEEE Access 7 (2019) 41525-41550. doi: 10.1109/ACCESS.2019.2895334. · DOI
  46. C. Yin, Y. Zhu, J. Fei, X. He, A deep learning approach for intrusion detection using recurrent neural networks, IEEE Access 5 (2017) 21954- 21961. doi:10.1109/ACCESS.2017.2762418. · DOI · Paper page
  47. K. Wu, Z. Chen, W. Li, A novel intrusion detection model for a mas- sive network using convolutional neural networks, IEEE Access 6 (2018) 50850-50859. doi:10.1109/ACCESS.2018.2868993. · DOI
  48. N. Altwaijry, A. ALQahtani, I. AlTuraiki, A deep learning approach for anomaly-based network intrusion detection, in: International Con- ference on Big Data and Security, Springer, 2019, pp. 603-615. doi: 10.1007/978-981-15-7530-3_46. · DOI
  49. I. Al-Turaiki, N. Altwaijry, A convolutional neural network for improved anomaly-based network intrusion detection, Big Data 9 (3) (2021) 233- 252. doi:10.1089/big.2020.0263. · DOI

Cited by

Sorted by citations

Metadata

Authors
Yagiz, M. A., & Goktas, P.
ORCID
Yagiz, Muhammet Anil
Venue
arXiv
Publisher
arXiv
Published
2025
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2501.00790
arXiv
2501.00790
OpenAlex
W4406032551
Cited by
12
References
0
Citations by year
2026: 3 · 2025: 9
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
intrusion detection, explainable AI, knowledge distillation, variational autoencoder, Industrial Internet of Things, resource-constrained environments, false positive reduction, network traffic classification

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review