AE-DSP: An Explainable Intrusion Detection Framework for Zero-Day Attacks Based on SHAP Contribution-Space Modeling

Abstract Zero-day attack detection is challenging because target attack classes are unavailable during training, preventing models from directly learning their class-conditional distributions or decision boundaries. Existing methods mainly construct unseen-attack detection criteria from raw traffic attributes, learned representations, classification outputs, or inter-class relationships, while sample-level relationships between input features and model decisions remain underexploited. To address this limitation, we propose AE-DSP, an explainable intrusion detection framework that transforms SHAP contributions from post-hoc explanations into task-relevant decision evidence. Within a unified contribution space, AE-DSP models two complementary forms of anomaly evidence: overall deviation from the normal contribution structure and dimension-wise contribution-deviation patterns represented by Deviation Semantic Prototypes. Because contribution dimensions remain aligned with the original traffic features, detection decisions can also be traced to dominant DeltaSHAP deviations. AE-DSP achieves F1-scores of 0.9341, 0.9250, and 0.9025 on NSL-KDD, UNSW-NB15, and CICIDS2017, with corresponding New Recall values of 0.9774, 0.9350, and 0.9251. Ablation studies, random-seed stability analyses, parameter-sensitivity analyses, and quantitative explainability experiments further demonstrate the effectiveness and complementarity of the proposed contribution-space modeling strategy.