Explainable <scp>AI</scp> ‐Driven Firewall Evaluation: Empowering Cybersecurity Decision‐Making for Optimal Network Defense

ABSTRACT The probability of network attacks is increasing daily due to the continuous development of tools and techniques that bypass the firewall and other network security boundaries. This motivates the researcher towards the upgradation and advancement in adaptive Artificial Intelligence (AI) based intrusion detection systems (IDS). The traditional machine learning (ML) based IDS has its limitations due to noise and the unexplainable nature of the decision‐making that took place during the implementation of the ML algorithm for categorization of attacked or normal data packets that arrive in the network. To address these issues, this research proposes an ML algorithm with the understanding of decisions through Explainable artificial intelligence (XAI). The dataset used for experimentation is IoTID20, which extracts data in a real‐time Internet of Things (IoT) environment. This paper compares the accuracy results of different ML algorithms such as Random Forest (RF), Extreme Gradient Boosting (XGBoost), Multilayer Perceptron –Neural Networks (MLP‐NN), Deep Neural Networks (DN), and Decision Tree (DT). During the classification of attacks, the Random Forest shows an accuracy of 93.80%, the XGBoost shows an accuracy of 97.30%, the Decision Tree shows an accuracy of 99.99%, the MLP Classifier—Neural Network shows an accuracy of 95.90%, and the Deep Neural Network (DNN) shows an accuracy of 94.60%. These algorithms are also analyzed with Precision, Recall, and F1‐Score. The proposed method of incorporating XAI increases the automation process with high accuracy and explainability of the decision to categorize anomalous and normal packets in an IoT environment. This remarkable achievement provides better intuitions in IDS with good protection in resistance to novel and unknown attacks.