GenIDS: An Explainable Deep Learning Intrusion Detection Framework Using Generative AI and Explainable Artificial Intelligence for Adaptive Cyber Threat Detection

The rapid growth of sophisticated cyber threats has exposed the limitations of traditional Intrusion Detection Systems (IDSs), particularly in detecting zero-day attacks, handling highly imbalanced datasets, and providing interpretable decision-making. While deep learning-based IDSs have significantly improved detection accuracy, their black-box nature limits trust and practical adoption in critical cybersecurity environments. Furthermore, the scarcity of labeled attack data reduces the ability of these models to generalize across emerging attack patterns. To address these challenges, this paper proposes XGenIDS, an explainable deep learning-based intrusion detection framework that integrates Generative Artificial Intelligence (GenAI) with Explainable Artificial Intelligence (XAI) for adaptive cyber threat detection. The proposed framework employs a Conditional Tabular Generative Adversarial Network (CTGAN) to synthesize realistic network traffic samples, thereby improving dataset diversity and mitigating class imbalance. A hybrid deep learning architecture combining Convolutional Neural Networks (CNN), Bidirectional Long Short-Term Memory (BiLSTM), and an attention mechanism is utilized to effectively capture both spatial and temporal characteristics of network traffic. To enhance transparency and analyst confidence, SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) are integrated to provide both global and local interpretations of model predictions. The proposed framework also incorporates a confidence-based decision module to reduce false positive alerts during real-time deployment. Experimental evaluation on benchmark intrusion detection datasets demonstrates that the proposed framework achieves superior detection accuracy, improved recall for minority attack classes, lower false alarm rates, and enhanced interpretability compared with conventional machine learning and deep learning approaches. The integration of synthetic data generation with explainable deep learning provides a reliable, transparent, and adaptive cybersecurity solution capable of addressing continuously evolving cyber threats.