Forensic-Oriented Intrusion Detection Using Synthetic Network Traffic Data and Explainable Artificial Intelligence

Digital forensic investigations of network intrusions require analytical outputs that are traceable, reproducible, and court-defensible — requirements that existing machine learning pipelines do not satisfy because they treat original evidence as training data and produce opaque classifications without instance-level justification. This paper presents a forensic-oriented intrusion detection framework that resolves both problems simultaneously, constituting the first integration of synthetic data generation, binary classification, and explainability within a single pipeline explicitly governed by ISO/IEC 27037, ISO/IEC 27041, ISO/IEC 27042, and NIST SP 800-86. The framework operationalises the ISO/IEC 27037 requirement for strict separation between original digital evidence and derived analytical artefacts — a requirement rarely implemented in machine learning workflows. Original datasets are treated as immutable, hash-verified artefacts; all training operates on parameterized synthetic derivatives generated via SDV + CTGAN. XGBoost binary classification provides high-performance detection on tabular network flow data, and SHAP TreeExplainer produces instance-level feature attributions that map statistical predictions to observable network behaviour for forensic reporting. Train-on-Synthetic, Test-on-Real (TSTR) evaluation on CICIDS2017 achieves F1-macro = 0.96, within cross-validation variance of the real-data baseline (0.97). Kolmogorov–Smirnov testing confirms synthetic privacy preservation (mean |KS| = 0.38) alongside operational utility. Cross-dataset validation on UNSW-NB15 and Kitsune identifies feature space dimensionality as the primary determinant of synthetic training effectiveness, establishing a practical deployment boundary of approximately 30 numeric flow-level features. SHAP attributions for Brute Force, Port Scan, and DoS attacks are consistent across real and synthetic instances, confirming that synthetic training preserves the forensically relevant attack fingerprints required for expert witness testimony.