ExplainabilityTransparencySecuritycs.CR
An explainable Recursive Feature Elimination to detect Advanced Persistent Threats using Random Forest classifier
Noor Hazlina Abdul Mutalib, Aznul Qalid Md Sabri, Ainuddin Wahid Abdul Wahab, Erma Rahayu Mohd Faizal Abdullah, Nouar AlDahoul
November 12, 2025
International Conference Control and Robots
1 citations
Key Takeaways
-
High accuracy with practical benefits: The proposed system achieved 99.9% detection accuracy for Advanced Persistent Threats while simultaneously reducing false positives and computational costs, meaning security teams would spend less time investigating false alarms and require fewer computing resources.
-
Explainability enables human oversight: By using SHAP (SHapley Additive exPlanations) to interpret which features the model relies on for threat detection, security professionals can understand why the system flagged a threat rather than treating it as a "black box," supporting more informed decision-making.
-
Feature selection improves efficiency: Recursive Feature Elimination narrowed down to the most significant indicators of threats, which not only improves model performance but also makes the system more transparent by focusing on fewer, more interpretable factors rather than overwhelming analysts with hundreds of data points.
-
Responsible AI in critical infrastructure: This work demonstrates that explainable AI approaches are feasible for high-stakes cybersecurity applications, suggesting that transparency and interpretability don't require sacrificing performance—an important finding for deploying trustworthy AI in critical systems.
Abstract
Intrusion Detection Systems (IDS) play a vital role in modern cybersecurity frameworks by providing a primary defense mechanism against sophisticated threat actors. In this paper, we propose an explainable intrusion detection framework that integrates Recursive Feature Elimination (RFE) with Random Forest (RF) to enhance detection of Advanced Persistent Threats (APTs). By using CICIDS2017 dataset, the approach begins with comprehensive data preprocessing and narrows down the most significant features via RFE. A Random Forest (RF) model was trained on the refined feature set, with SHapley Additive exPlanations (SHAP) used to interpret the contribution of each selected feature. Our experiment demonstrates that the explainable RF-RFE achieved a detection accuracy of 99.9%, reducing false positive and computational cost in comparison to traditional classifiers. The findings underscore the effectiveness of integrating explainable AI and feature selection to develop a robust, transparent, and deployable IDS solution.