A Review of Explainable Deep Learning for Intrusion Detection in SDN Balancing Accuracy and Interpretability in Software-Defined Networking Security

Abstract Software-Defined Networking (SDN) centralizes policy and programmability, while simultaneously concentrating risk in the controller. Deep Learning (DL) has advanced network intrusion detection systems (IDS) beyond rule-based and shallow methods; however, opaque model decisions limit adoption in high-stakes control planes. We review deep learning architectures, including convolutional, recurrent, Transformer, and hybrid models. We analyze performance on canonical datasets (CICIDS2017, UNSW-NB15, CSE-CICIDS2018, ToN_IoT), discuss controller-aware metrics (latency, throughput, rule-install delay), and synthesize deployment lessons from testbeds. We find that Transformers and hybrids often exceed 99% accuracy, while post-hoc XAI provides actionable transparency with modest overhead. “Key gaps identified are, offlineonly evaluation, missing controller latency reporting, and limited in-loop explanations. We outline a practical roadmap toward real-time, explainable SDN IDS: efficient attention, standardized SDN–XAI benchmarks, and human-centered validation. Keywords Software-Defined Networking, Intrusion Detection System, Deep Learning, Explainable AI, CNN, LSTM, Transformer, SHAP, LIME.