XAI FL-IDS: A Federated Learning and SHAP-Based Explainable Framework for Distributed Intrusion Detection Systems

Privacy protection through local processing: The framework keeps sensitive network data on individual devices rather than sending it to a central server. Only model updates are shared, significantly reducing privacy risks for organizations and IoT networks handling sensitive information.

Transparency in security decisions: By using SHAP (SHapley Additive exPlanations), the system explains why it flagged a potential attack, showing which specific features influenced each detection decision. This addresses a critical gap in conventional intrusion detection systems that only flag threats without explanation.

High accuracy with practical efficiency: The system achieved over 99% accuracy in detecting intrusions while operating on distributed devices, demonstrating that privacy-preserving approaches don't require sacrificing security performance.

Scalability for IoT environments: The federated learning approach reduces computational overhead on individual IoT nodes by allowing them to train locally rather than constantly transmitting data to a central server, making the system more practical for large-scale network deployments.

Dual accountability mechanism: Detections are explained at both the local device level and central server level, creating multiple checkpoints where security decisions can be audited and understood—important for organizations needing to justify security actions to stakeholders or regulators.