LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity

Explainability improves cybersecurity trustworthiness: LENS-XAI incorporates "attribution-based explainability techniques" to make intrusion detection decisions transparent, addressing a critical gap where security systems often operate as "black boxes." This transparency is essential for security teams to understand why a system flagged a potential threat and trust its recommendations.

Lightweight design enables security for resource-limited devices: The framework achieves high detection accuracy (95.34%-99.92% across four datasets) while using only 10% of available training data, making it practical for Industrial Internet of Things (IIoT) systems and edge devices with limited computational power—environments where traditional security systems are often too demanding.

Reduced false positives decrease alert fatigue: By "excelling in reducing false positives," LENS-XAI addresses a major operational challenge where security teams are overwhelmed by incorrect threat alerts. Fewer false alarms means security personnel can focus on genuine threats rather than investigating benign activities.

Scalability across diverse systems improves real-world deployment: The framework demonstrates strong performance across four different benchmark datasets (Edge-IIoTset, UKM-IDS20, CTU-13, and NSL-KDD), suggesting it can adapt to different network environments and attack types—a crucial requirement for organizations with heterogeneous IT infrastructure.

Balancing performance with interpretability addresses a key responsible AI challenge: Rather than choosing between accuracy and explainability, LENS-XAI achieves both simultaneously, demonstrating that security systems can be both effective and understandable to human operators.