A hybrid intrusion detection framework integrating multi-layer perceptron, SMOTE, and non-IID federated learning with explainable AI

Abstract

Exponential cyber threat growth necessitates sophisticated Intrusion Detection Systems (IDS) that maintain data confidentiality in distributed settings. This study proposes a novel, privacy-preserving IDS framework that synergizes Federated Learning (FL), Deep Learning, and Explainable Artificial Intelligence (XAI). Specifically, a lightweight Multi-Layer Perceptron (MLP) architecture is optimized with the Synthetic Minority Over-sampling Technique (SMOTE) to effectively mitigate class-imbalance in the CICIDS2017 dataset. To overcome the “black-box” limitation of deep learning, SHapley Additive exPlanations (SHAP), PCA, and t-SNE are integrated to provide high-fidelity feature interpretability. Critically, to prevent the data leakage that inflates many reported IDS results, SMOTE and all feature scaling are fitted exclusively on the training partition after a stratified 80/20 split, leaving the test set untouched throughout. Under this leakage-free protocol, the centralized model attains a weighted F1-score of 0.974 (accuracy 96.49%), and five-fold cross-validation across three random seeds yields a weighted F1-score of 0.9881 ± 0.0042, confirming the stability of the result. Under stringent non-IID conditions (Dirichlet α = 0.5) across 10 distributed clients, the federated framework sustains a weighted F1-score of 0.9167, while a controlled ablation confirms that SMOTE outperforms class-weighting and no-rebalancing baselines. This framework demonstrates an optimal trade-off between lightweight local threat detection, enhanced minority class recognition, and privacy-preserving decentralized learning for edge computing.