Explainable attention based few shot LSTM for intrusion detection in imbalanced cyber physical system networks

Intrusion Detection Systems (IDS) play a critical role in securing Cyber-Physical Systems (CPS); however, many existing approaches struggle with imbalanced network traffic, high false positive rates, limited detection accuracy, and insufficient explainability. To address these challenges, this study proposes HeXAI-AttentionCPS, a hybrid Explainable AI–based IDS that combines an attention-enhanced few-shot Long Short-Term Memory (LSTM) network with focal loss and Principal Component Analysis (PCA). The proposed framework is designed to improve intrusion detection performance under severe class imbalance while maintaining model transparency. To enhance interpretability, SHapley Additive exPlanations (SHAP) are employed to provide insights into feature contributions influencing detection decisions. The proposed approach is evaluated using the benchmark ToN_IoT2020 dataset. The experimental results demonstrate that HeXAI-AttentionCPS achieves superior performance in terms of accuracy, precision, recall, and F1-score, while consistently maintaining a low false positive rate compared with state-of-the-art IDS techniques. These findings indicate that the proposed framework offers an effective and interpretable solution for robust intrusion detection in CPS environments.