AN AI-DRIVEN EXPLAINABLE VISUAL ANALYTICS FRAMEWORK FOR AUTOMATED SCIENTIFIC ANALYSIS AND PUBLICATION OF CYBERSECURITY DATA

Abstract

Machine-learning studies of intrusion-detection data often report near-perfect scores from single splits, hand-picked figures and unvalidated explanations. We present XVA-Cyber, a reproducible framework that takes a cybersecurity dataset to statistically validated, explained and provenance-tracked figures and tables. It combines leakage-aware preprocessing, five feature rankers, seven model families, a quantitative SHAP-LIME comparison, Friedman and Holm-corrected Wilcoxon tests with effect sizes, feature-aligned cross-dataset transfer, and ICVRE, a transparent rule-based engine that plans the figures an analysis needs and records why others are omitted. On CIC-IDS2017, CICIoT2023 and UNSW-NB15, de-duplication removed 11.7-36.8% of the records, and label conflicts limited attainable scores. The best multiclass macro F1 was 0.994, 0.701 and 0.622, respectively, but random forest, XGBoost and LightGBM never differed significantly from one another in any of the six dataset-task runs. TreeSHAP was 22-156 times faster than LIME, and its top features beat a random deletion baseline in 6 of 6 runs against 3 for LIME. Transfer between datasets on aligned features collapsed although within-dataset detectors on the same features performed well. ICVRE's figure choices matched those of published XAI-IDS papers for 80% of the scored recommendations, and each run produced 12 figures and 8 tables from one command. A re-execution reproduced 49 of 61 artifacts byte for byte; the rest differed only in measured timings or by floating-point noise below 10⁻⁷.