INTERPRETABLE NETWORK INTRUSION DETECTION ON CICIDS2017 USING CORRELATION-BASED FEATURE SELECTION, A HYBRID CNN-LSTM CLASSIFIER AND SMOTE-BALANCED XGBOOST COMPARISON

Modern enterprise networks generate millions of flows per day, and signature-based intrusion detection cannot keep pace with novel attack patterns. Deep learning has narrowed the detection gap, but at the cost of high computational overhead, opacity to security analysts, and persistent sensitivity to class imbalance. This project addresses the three concerns simultaneously on the CICIDS2017 benchmark by combining (i) correlation-based feature selection (CFS), which prunes seventy-eight raw features to a compact non-redundant subset; (ii) a four-way comparative evaluation of a Random Forest baseline, a stacked LSTM in the style of the Donkol et al. (2023) base paper, a hybrid CNN-LSTM following Alsaiari and Ilyas (2025), and an XGBoost classifier trained on data balanced with the Synthetic Minority Over-sampling Technique (SMOTE); and (iii) post-hoc SHapley Additive exPlanations (SHAP) attribution applied to the strongest classifier, exposing the features that drive attack-class predictions. Experimental results on a stratified 200,000-flow sample show that the Random Forest achieves the highest F1-score (0.9926) with the lowest false positive rate (0.07 percent), XGBoost+SMOTE achieves the highest attack recall (0.9932) at one twenty-fifth of the deep-model training time, the proposed CNN-LSTM beats the plain LSTM by 2.4 F1 percentage points, and SHAP attribution identifies backward-direction packet length statistics as the dominant features driving attack predictions. The findings answer three research questions about feature selection, model architecture, and interpretability in operational IDS deployment, and contradict the common assumption that deep models always dominate on tabular IDS data.