TabNet for Intrusion Detection: Bridging Accuracy and Interpretability in Tabular

Intrusion Detection Systems (IDS) must balance accuracy with interpretability, yet existing approaches often sacrifice one for the other. Classical machine learning methods such as Logistic Regression and Random Forest provide solid accuracy but limited transparency, while deep learning models like CNNs act as black boxes. This paper evaluates TabNet, a deep neural architecture designed for tabular data, as a candidate for IDS. TabNet leverages sequential attention and sparse feature selection, enabling both high performance and feature-level interpretability. We test TabNet on UNSW-NB15, BoT-IoT, and KDD CUP and compare it with Logistic Regression, Random Forest, SVM, and Naïve Bayes. Results show that TabNet achieves near-perfect detection on BoT-IoT (99.98%) and KDD (99.98%), while remaining highly competitive on UNSW-NB15 (99.30%). Its attention masks highlight meaningful features such as flow duration and packet rate, providing actionable insights for analysts. TabNet thus offers a practical trade-off between accuracy and explainability, making it well-suited for next-generation IDS.