Abstract
As networked systems become central to modern infrastructure, Intrusion DetectionSystems (IDS) form a critical line of defense. However, the opaque nature of machine
learning models used in these systems limits trust and practical adoption, and security
stakeholders remain reluctant to act on large language model (LLM) output without
independent verification. This thesis proposes a stakeholder-specific Explainable AI
(XAI) framework for network packet analysis that treats the trust gap between users
and LLMs as its central problem: the system produces four role-tailored explanations
of the same detection, one each for a Security Analyst, an IT Manager, a Software
Developer, and a Compliance Officer, so that each stakeholder receives the evidence and
framing they need to act with confidence. The integrated system utilizes a CNN-LSTM
hybrid deep learning model for packet classification, combined with SHAP and LIME
for global and local feature attribution. A locally deployed, GGUF-quantized Mistral
7B LLM pipeline then translates these technical attributions into human-readable
narratives. Evaluated on the UNSW-NB15 and NSL-KDD benchmark datasets, the
CNN-LSTM classifier achieved 96.76% accuracy and an F1-score of 0.9675. The
XAI layer demonstrated high faithfulness, achieving a sufficiency metric of 0.9390,
indicating that top features strongly preserve model predictions. Furthermore, the
LLM generator successfully produced valid, stakeholder-specific narratives without
syntactic contamination, observing only a minor 5.5% semantic hallucination rate on
the evaluation set. Ultimately, this framework bridges the gap between complex IDS
models and human operators by restoring the evidence chain that each stakeholder
needs to trust and act on automated security output.