A Calibrated and Explainable Bimodal Machine Learning Framework for Hybrid Intrusion Detection

Explainability improves trustworthiness in security systems: The framework uses SHAP analysis to show that the model's decisions are based on legitimate security features rather than spurious patterns, addressing a key concern about "black-box" AI systems making critical security decisions without human understanding.

Handling rare threats requires deliberate technical choices: The paper demonstrates that detecting uncommon attacks (like specific types of web exploits) requires specific interventions—including hybrid resampling techniques and adaptive thresholding—rather than relying on standard machine learning approaches, highlighting that responsible AI must be tailored to real-world problems.

Calibration matters for operational deployment: By using isotonic calibration and setting specific decision thresholds (τ=0.30 for XSS attacks), the framework achieves 90%+ detection rates for some unknown attacks while maintaining only 1% false alarms, showing that responsible AI systems must balance competing priorities like sensitivity and specificity for practical use.

Simpler models can outperform complex ones: The framework achieves strong results without deep learning's complexity, suggesting that responsible AI doesn't always require the most sophisticated techniques—sometimes interpretable, well-tuned traditional machine learning is more appropriate for high-stakes security applications.

Reproducibility and domain expertise are essential: The paper emphasizes security-oriented feature engineering and provides a reproducible framework, underscoring that responsible AI in cybersecurity requires collaboration between AI developers and domain experts rather than treating security as a generic classification problem.