X-THREAT framework for adaptive and explainable deep learning-based minority-class and zero-day cyber threat detection

Author First name, Last name, Institution

• Samina Naz Qaisarani, Gomal University
• Sahar K. Badri, Faculty of Computing and Information Technology, King Abdulaziz University
• Asad Khattak, Zayed University, Abu Dhabi CampusFollow
• Daniyal M. Alghazzawi, Faculty of Computing and Information Technology, King Abdulaziz University
• Mohammed Yahya Alghamdi, Al Baha University
• Mona Alkhozae, Faculty of Computing and Information Technology, King Abdulaziz University
• Abeer Almakky, Faculty of Computing and Information Technology, King Abdulaziz University
• Rania M. Alhazmi, Faculty of Computing and Information Technology, King Abdulaziz University
• Muhammad Zubair Asghar, Gomal University

Document Type

Article

Source of Publication

Scientific Reports

Publication Date

12-1-2026

Abstract

The dynamic nature of cyber threats—particularly minority-class and zero-day attacks—poses significant challenges to existing intrusion detection systems (IDS), which often lack adaptability, interpretability, and robustness. This paper presents X-THREAT, an adaptive and explainable deep learning framework designed to improve detection of rare and previously unseen cyber threats. Unlike prior approaches that treat detection, augmentation, and explainability separately, X-THREAT integrates these components within a unified pipeline. A hybrid VAE–GAN module enhances minority-class representation during training, while a CNN–BiLSTM–attention model performs threat detection, and a context-aware SHAP mechanism provides interpretable insights into model decisions. Experimental results on three benchmark datasets—CICIDS2017, UNSW-NB15, and ToN-IoT—show that X-THREAT consistently outperforms representative deep learning baselines. The model achieves 96.3% accuracy and 95.5% F1-score on CICIDS2017, 94.1% accuracy and 92.5% F1-score on UNSW-NB15, and 93.2% accuracy and 91.5% F1-score on ToN-IoT, along with improved minority-class recall and reduced false positive rates. AUC-ROC values of 0.97, 0.95, and 0.94 further demonstrate strong discriminative capability. Zero-day detection capability is evaluated using a leave-one-attack-class-out protocol, and interpretability is assessed through fidelity analysis and comparison with static SHAP and LIME methods. Results indicate consistent performance across independently evaluated datasets, suggesting potential for generalization. From a deployment perspective, computationally intensive components are restricted to offline training, while inference relies on the detection model with optional explanation. However, latency, resource usage, and edge deployment feasibility were not explicitly benchmarked and remain important directions for future work. Overall, X-THREAT provides a robust and interpretable framework for modern intrusion detection, with improved performance on minority-class and zero-day threat scenarios.

DOI Link

10.1038/s41598-026-63529-5

ISSN

2045-2322

Publisher

Springer Science and Business Media LLC

Volume

16

Issue

1

Disciplines

Computer Sciences

Keywords

Adaptive intrusion detection, Cyber threat simulation, Deep learning security, Explainable AI (XAI), Hybrid CNN-BiLSTM, Minority-class threat detection, Network traffic analysis, SHAP-based interpretability, VAE-GAN synthesis, Zero-day attack detection

Scopus ID

105050588012

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

Recommended Citation

Qaisarani, Samina Naz; Badri, Sahar K.; Khattak, Asad; Alghazzawi, Daniyal M.; Alghamdi, Mohammed Yahya; Alkhozae, Mona; Almakky, Abeer; Alhazmi, Rania M.; and Asghar, Muhammad Zubair, "X-THREAT framework for adaptive and explainable deep learning-based minority-class and zero-day cyber threat detection" (2026). All Works. 8429.
https://zuscholars.zu.ac.ae/works/8429

Indexed in Scopus

yes

Open Access

yes

Open Access Type

Gold: This publication is openly available in an open access journal/series