An explainable XGBoost–MLP fusion framework for intrusion detection in 5G and beyond networks

Abstract Fifth-generation (5G) and beyond networks combine virtualization, network slicing, massive device connectivity, and multi-access edge computing, thereby increasing both service flexibility and cybersecurity exposure. This paper presents an explainable ensemble intrusion-detection framework that combines Extreme Gradient Boosting (XGBoost) and a compact multilayer perceptron (MLP) through validation-controlled probability fusion. The framework also integrates class-imbalance handling, feature selection, SHapley Additive exPlanations (SHAP), Local Interpretable Model-Agnostic Explanations (LIME), and explanation-aware security actions. Evaluation on the public 5G-NIDD benchmark used a stratified 70:15:15 training-validation-test split, common preprocessing for all models, and validation-only hyperparameter and fusion-weight selection. On the fixed held-out test split used in the supplied experiment log, the ensemble achieved 99.3% accuracy, 99.2% precision, 99.1% recall, 99.1% F1-score, 99.7% area under the receiver operating characteristic curve, and a 0.9% false-positive rate. The corresponding 95% Wilson interval for accuracy was 99.21-−99.38%, which describes sampling uncertainty on this test split rather than random-seed variability. SHAP identified packet rate, flow duration, SYN behavior, destination-port entropy, source bytes, and connection state as influential global indicators, while LIME supported alert-level validation. Detection required 22.6 ms per flow after warm-up, whereas generating both SHAP and LIME explanations increased end-to-end latency to 83.3 ms. These measurements motivate a two-path deployment strategy: continuous low-latency edge detection and selective explanation generation for high-risk, uncertain, or policy-sensitive alerts. A fixed-test statistical analysis using Wilson confidence intervals and Holm-adjusted accuracy comparisons confirmed that the reported improvement over every baseline was significant at adjusted $$p<0.001$$ on the held-out sample; random-seed variability is stated separately as a limitation.