Cyber Threat Intelligence-Enhanced Lightweight Explainable AI for Real-Time Intrusion Detection

In today's cyberspace, with large-scale and complex threats, it is a priority for an Intrusion Detection System (IDS) to be a real-time transparent machine for security experts. Then again, IDSs powered by machine learning, mainly with deep learning models, have a problem in that they work as "black boxes" and only provide alarms without a rationale understandable by humans, and explainability techniques like SHAP, and LIME add delay to the process, which hinders real-time use. This study proposes a Cyber Threat Intelligence (CTI) Enhanced Lightweight Explainable Artificial Intelligence (XAI) system for intrusion detection, as it is a real-time requirement for intrusion. A CTI Lightweight XAI model was developed and tested using the UNSW-NB15 dataset, which contains over 2.5 million network traffic records. The dataset was augmented by introducing a threat feed containing the 42,854 known malicious IP addresses extracted from AlienVault Open Threat Exchange (OTX) and as a result, the CTI match rate was 99.26%. The data was cleaned, feature engineered and normalized. Next, a Deep Neural Network (DNN) with around 37,000 trainable parameters and a progressive architecture: Input (209) 128 64 32 Output (2) was developed. Gradient-based saliency map was chosen for the real-time explainability part, which calculates feature importance via a single backward pass. The model results in an accuracy of 99.14%, an F1 score of 99.13%, and an ROC AUC of 0.9989 with a false positive rate of 0.40% and a latency of inference of 0.0016 milliseconds per sample. This reveals that integrating threat intelligence into the dataset with a lightweight deep learning model and a gradient-based explanation is a feasible combination for an IDS that offers high accuracy, is very fast, and has a good level of interpretability. In conclusion, the proposed model is a promising solution for practical, real-world, and fast implementation that can help with timely and trustworthy intrusion detection in a Security Operations Centre (SOC) setup without compromising interpretability. Future work will investigate the integration of multiple real-time threat intelligence feeds, continuous model updating to address evolving cyber threats, and more advanced lightweight XAI techniques to further improve interpretability while maintaining low detection latency.