An Explainable Hybrid Feature Selection Framework for Deep Learning-Based Intrusion Detection

High-dimensional network traffic data can increase the computational cost of intrusion detection systems, introduce redundant information, and reduce model interpretability. Severe class imbalance can further impair the detection of minority attack classes. This study proposes IG2AFS-DNN, an explainable hybrid feature selection framework that combines information gain filtering with a deep neural network-guided genetic algorithm. Information gain first removes weakly relevant features, after which the genetic algorithm identifies a compact feature subset by jointly considering macro F1 and dimensionality reduction. A deep neural network performs multiclass intrusion detection, while SHAP provides global and local post hoc explanations of model predictions. The framework was evaluated on the CSE-CIC-IDS2018 and TII-SSRC-23 datasets. It reduced the CSE-CIC-IDS2018 feature set from 80 to 23 features (a 71.25% reduction) and the TII-SSRC-23 feature set from 86 to 15 features (an 82.56% reduction). The resulting models achieved macro F1-scores of 0.833 and 0.992 and Matthews correlation coefficients of 0.972 and 0.999 on CSE-CIC-IDS2018 and TII-SSRC-23, respectively. Ablation and baseline comparisons showed that the complete hybrid framework outperformed the full-feature DNN and conventional linear and probabilistic classifiers while remaining competitive with tree-based ensemble models. SHAP analysis indicated that the selected features captured meaningful packet, flow, timing, and protocol characteristics. These findings demonstrate that IG2AFS-DNN provides a favorable balance among feature compactness, multiclass detection performance, and model interpretability across two heterogeneous intrusion detection datasets.