TY - EJOU AU - Atoum, Mohammed AU - Al-Essa, Malik AU - Alsarhan, Yazeed AU - Hwaitat, Ahmad K. Al AU - Imran, Muhammad TI - LLM Enhanced Explainable Intrusion Detection System for Generating Actionable Security Insights T2 - Computers, Materials \& Continua PY - VL - IS - SN - 1546-2226 AB - With the urgent need for Intrusion Detection Systems (IDS) to protect digital infrastructure, eXplainable Artificial Intelligence (XAI) has become an important supporting layer. The integration of XAI and IDS can rank influential features that affect IDS decisions, yet these outputs often remain difficult to translate into operational security actions. In this work, we propose LEXIS (LLM-Enhanced eXplainable Intrusion detection System), an LLM-enhanced explainable IDS that converts sample-level explanations into structured report drafts that organize feature attributions into candidate response actions for analyst review, through an evidence-bounded reporting process. Given a network trace, the classifier generates a prediction for that sample, while an XAI method generates a top-k explanation set with attribution scores. Then, an LLM is prompted to produce a machine-readable incident report in a fixed JSON schema, which includes suspected causes, confidence cues, false-positive checks, and recommended response actions extracted from a predefined action catalog. To investigate the effect of adversarial attacks against both the classifier and the XAI method, we evaluate explanation stability under normalized feature-space Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks using a signed-rank stability metric that separately reports feature-rank reordering through Kendall tau correlation and attribution-sign agreement between clean and attacked samples, each with bootstrap confidence intervals and permutation-test significance. The experiments are evaluated on the CICIDS2017 dataset, where the proposed model achieves high detection performance on the majority traffic classes, while minority and subtle attack classes remain more challenging. Focal-loss training with per-class threshold calibration raises macro-F1 from 0.726 to 0.776 on the imbalanced class distribution. The stability analysis shows that feature-space adversarial perturbations only partially disrupt explanations, with feature ranks retaining substantial order and attribution signs agreeing significantly above chance level. The findings suggest that coupling XAI with grounded LLM summarization can help transform raw feature attributions into standardized triage-oriented report drafts. We evaluate the framework as a benchmark-based prototype, and broader validation on diverse datasets, real Security Operations Center (SOC) logs, analyst-in-the-loop assessment, and problem-space adversarial attacks remains future work. KW - XAI; intrusion detection systems; SHAP; adversarial attacks; deep learning; large language models DO - 10.32604/cmc.2026.085403