Software-defined networking (SDN) represents a paradigm shift in network management, but its centralized control plane introduces new and severe security vulnerabilities. Conventional intrusion detection systems, including signature- and rule-based methods, lack adaptability and interpretability in the face of evolving threats. This paper proposes a multi-hybrid deep learning fusion ensemble (MHDLFE) to enhance intrusion detection in SDN environments. The framework integrates Deep Neural Networks (DNNs), Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), and Long Short-Term Memory (LSTM) models via feature fusion and a meta-classifier, thereby improving both detection performance and robustness. To address the critical need for transparency in security systems, the proposed approach incorporates Explainable AI techniques, specifically Shapley Additive Explanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME), providing interpretable insights into model decisions. The proposed model achieves strong performance on the NSL-KDD and CIC-IDS2017 datasets, attaining near-perfect binary classification scores of 97.91% and 93.30%, and multiclass accuracies of 98.61% and 97.91%, respectively. These results demonstrate that the proposed framework delivers an effective and trustworthy SDN intrusion detection system by combining deep learning, ensemble fusion, and explainable AI to support accurate, transparent, and reliable cybersecurity decision-making.

Internet of Things (IoT) environments, which are distributed and resource-constrained, present unique security challenges, making it essential to develop robust and transparent intrusion detection system (IDS) solutions. This study presents a specialized system for IoT environments that combines hybrid feature selection methods with anomaly detection algorithms and classification strategies, alongside explainability techniques, to enhance security measures and event transparency. The novelty of this work lies in combining several modern approaches: hybrid feature selection by combining Random Forest (RF) and SelectKBest to reduce computational overhead while preserving high accuracy of detection; the application of Deep Autoencoders (DAEs) for detecting anomalous traffic deviating from learned normal behavior, enabling detection of previously unseen attack patterns under controlled experimental conditions; feedforward neural networks (FNNs) are applied to classify anomalous data with high accuracy and reduced training time, and explainability tools such as Shapley Additive Explanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME) are incorporated to provide insights into model decisions and improve trust. We utilize the CIC-IDS2017 and EIIoT datasets to evaluate their effectiveness in identifying critical cyber threats and subsequently classifying them. This proposed framework, HDATL-XAI (Hybrid Dimension-reduction Autoencoder and Traditional Learning with Explainable Artificial Intelligence), integrates advanced techniques to offer comprehensive protection while ensuring transparency, enhancing security and trustworthiness, and serving as an essential tool for protecting IoT networks.

The Internet of Things (IoT) networks have introduced significant cybersecurity vulnerabilities, and traditional Intrusion Detection Systems (IDSs) have proven inadequate for addressing IoT-specific threat landscapes. Existing machine learning-based IDS approaches suffer from three critical limitations: (i) poor generalization across heterogeneous IoT architectures and protocols, leading to degraded detection performance in diverse ecosystems; (ii) high false positive rates (often exceeding 15–20%), undermining operational feasibility; and (iii) static learning models that cannot adapt to polymorphic and zero-day attacks. To overcome these challenges, we propose the Meta-Classification Ensemble Stacking with Convolutional Neural Networks (MCES-CNN), a novel, adaptive, and interpretable IDS framework specifically engineered for IoT environments. MCES-CNN introduces three key innovations: (1) a meta-classification mechanism that utilizes ensemble stacking of traditional classifiers to generate high-level predictive features, which an optimized CNN further processes to enable robust cross-domain generalization; (2) integration of the Local Interpretable Model-Agnostic Explanation (LIME) framework for quantitative feature attribution, enabling explainable decisions and interpretability-guided reduction of false positives; and (3) a compression-aware design incorporating structured pruning and quantization, evaluated in terms of memory footprint and inference latency on representative IoT hardware, which maintains detection efficacy while ensuring computational efficiency for deployment on resource-constrained edge devices. Experimental validation on benchmark datasets CIC-IDS2017, EIIoT, and RT-IoT2022- demonstrated the effectiveness of MCES-CNN, achieving 99.95% binary and 98.29% multiclass accuracy, with consistent performance (98.28%) on RT-IoT2022. Notably, it reduces false positives by 98.4%, 79%, and 99.2%, respectively, while outperforming state-of-the-art methods by 13% in terms of precision. These results affirm MCES-CNN as a scalable, interpretable, and deployable IDS solution for real-world IoT security.