Adaptive AI Guardian: An Explainable Deep Learning System for Real-Time Cyber Threat Detection

Abstract

The increasing complexity, frequency, and adaptability of cyber threats require intrusion detection systems (IDSs) that can identify malicious activity rapidly while providing interpretable evidence for security analysts. Conventional machine-learning and deep-learning IDSs have demonstrated strong detection capabilities, but their black-box nature can limit operational trust, particularly when security decisions must be made in real time. This study develops Adaptive AI Guardian, an explainable deep-learning framework designed to integrate adaptive threat detection with post-hoc model interpretation. The proposed framework combines network traffic preprocessing, deep-learning-based intrusion classification, adaptive threat profiling, and Explainable Artificial Intelligence (XAI) using SHAP and LIME. The study adopts a design-and-development research approach based on publicly available cybersecurity datasets, with a multidimensional evaluation covering accuracy, precision, recall, F1-score, false-positive rate, inference latency, throughput, and explanation consistency. The proposed architecture is designed to distinguish normal from malicious traffic while identifying the principal features contributing to each prediction. The framework addresses limitations identified in prior studies concerning explainability, evolving attacks, false positives, scalability, and real-time deployment. The manuscript does not yet report empirical measurements for these indicators; therefore, the study does not claim quantitative superiority over existing IDS approaches. Instead, its main contribution is the development of an integrated architecture and evaluation framework ready for subsequent empirical validation, including cross-dataset testing, concept-drift analysis, adversarial robustness, and real-time deployment assessment. The framework is expected to serve as a foundation for developing trustworthy adaptive IDSs for enterprise networks, Internet of Things environments, and emerging cyber-physical infrastructures.