Search

The escalating complexity of malicious digital activities highlights the necessity for dependable and transparent intrusion detection systems (IDS) to preserve network integrity. Although machine learning frameworks like Decision Tree (DT), Random Forest (RF), k-Nearest Neighbors (K-NN), and XGBoost demonstrate exceptional capabilities in identifying malicious behavior, their inner mechanics grow increasingly opaque as structural complexity and predictive precision expand, creating challenges for high-stakes safety operations. Local Interpretable Model-agnostic Explanations (LIME) is frequently deployed to mitigate this issue; nevertheless, its dependency on Gaussian distributions when generating data variations often fails to capture the non-linear and disproportionate traits of frameworks like CIC-IDS-2018. To overcome these limitations, we introduce an adapted LIME variation strategy utilizing Weibull, Gamma, Beta, and Pareto distributions to more accurately represent the attributes of network telemetry. Our framework enhances the consistency of diverse machine learning systems optimized on CIC-IDS repositories, yielding more constructive and dependable rationales for predictive outputs. These proposed algorithmic adjustments yield a gain in explanatory fidelity of up to 78% relative to the standard normal distribution framework. Variations rooted in the Pareto distribution deliver the most optimal outcomes. Across all evaluated distributions, the Pareto framework consistently generated the peak explanation fidelity and consistency, notably for K-NN (R^2 = 0.9971, S = 0.9907) and DT (R^2 = 0.9267, S = 0.9797). This demonstrates that heavy-tailed distributions align effectively with actual network operational trends, minimizing the discrepancy in attribute significance justifications and rendering them more resilient.