Beyond The Classifier: Dual-Path Explanation of A Hybrid CNN–Transformer–Autoencoder Intrusion Detection System

Abstract

Hybrid intrusion detection architectures increasingly couple a discriminative classifier with a generative reconstruction branch, yet the explainability literature for network security still treats such detectors as if they had a single output. Post-hoc attribution is applied to the classifier, and the anomaly branch — the component that actually carries the burden of detecting unseen attacks — is left unexplained. This paper investigates that gap directly. Building on a previously published Hybrid Attentive Convolutional Autoencoder (HACA), we introduce X-HACA, a dual-path explanation framework comprising three components: Reconstruction Error Decomposition (RED), an exact, closed-form, zero-query attribution of the anomaly score over input features; Attention-Screened Shapley Estimation (ASSE), a two-stage estimator that uses an attention–gradient prior to reduce the effective player count of the Shapley game; and Dual-Path Consensus Explanation (DPCX), a log-pooled fusion of the two paths. Experiments on the official NSL-KDD and UNSW-NB15 partitions expose a blind spot that has gone unmeasured: on NSL-KDD, the top-10 features selected by KernelSHAP account for only 31.6% of the reconstruction evidence the detector actually acts upon, and LIME for 38.9%, whereas DPCX captures 96.5% while remaining competitive on classifier faithfulness. DPCX is the only method examined that is faithful to both heads on both datasets. We further report two deliberate negative results. Attention-guided importance sampling of Shapley coalitions collapses, retaining an effective sample size of 1.5%; and explanation-derived novelty signals — divergence between paths and conformity to class prototypes — do not improve zero-day detection over the reconstruction error itself, which reaches 89.47% AUROC against 78.79% for maximum softmax probability and 79.61% for the energy score. Finally, we show that 56.9% of the 3,750 genuinely unseen attack instances in KDDTest+ are misclassified as normal by the classifier, and that the anomaly branch recovers 46.0% of them at a 5% false-positive rate, quantifying the operational value of explaining both paths rather than one.