arXiv: Explaining Intrusion Alert Decisions of Deep Learning-based Network Intrusion Detection Systems for Security Analysts

This publication introduces a new framework for explaining the decisions made by deep learning-based network intrusion detection systems (NIDS) to security analysts. While not a regulatory change itself, it directly addresses a critical compliance gap under the EU AI Act’s AI_SAFETY framework, which requires high-risk AI systems to be transparent and explainable. The paper proposes methods to generate human-readable justifications for why a specific network alert was flagged, moving beyond black-box outputs that are difficult to audit or defend in regulatory reviews.

The primary affected organizations are those deploying or developing AI-driven cybersecurity tools within the EU, particularly in critical infrastructure, finance, healthcare, and telecommunications sectors. Any entity using deep learning NIDS that could impact network security decisions must now consider whether their systems meet the Act’s explainability requirements. Compliance teams in these sectors should immediately assess whether their current NIDS can produce auditable explanations for each alert, as regulators will expect demonstrable transparency.

Compliance teams should next conduct a gap analysis between their existing NIDS outputs and the explainability standards implied by this research. They should engage with technical teams to pilot the proposed explanation methods, document how alerts are interpreted, and prepare for potential audits. Additionally, they should monitor the European Commission’s guidance on high-risk AI transparency, as this paper signals that black-box intrusion detection may no longer be sufficient for regulatory compliance.