Seeing Through the Perimeter: An Explainable Deep Learning Framework for Real-Time Cyber Threat Detection in Zero Trust Networks

Abstract

Zero trust architectures have redefined enterprise network security by discarding the assumption of implicit
trust within organizational perimeters, yet the deep learning models that increasingly power intrusion detection
within these architectures remain largely opaque to the analysts who must act on their outputs. This opacity
creates a governance problem as much as a technical one, since security teams cannot audit, contest, or learn
from decisions they cannot interpret. This paper proposes and evaluates an explainable deep learning framework
designed to support real time cyber threat detection within zero trust network environments, combining a hybrid
convolutional and recurrent architecture for traffic classification with post hoc interpretability layers drawn from
Shapley additive explanations and local surrogate modeling. The study adopts a mixed methods design, pairing
quantitative benchmarking on encrypted and unencrypted network traffic datasets with a qualitative evaluation of
explanation quality conducted through structured analyst review. Findings indicate that the proposed framework
sustains detection accuracy comparable to established black box baselines while producing explanations that security
analysts rate as substantially more actionable, particularly for previously unseen attack variants. The research further
demonstrates that explanation fidelity, rather than raw predictive accuracy, is the variable most strongly associated
with analyst trust and downstream remediation speed. These findings extend the growing literature on explainable
intrusion detection by situating interpretability within the operational logic of zero trust verification rather than
treating it as a peripheral audit feature. The paper concludes by outlining implications for security operations design,
the limitations inherent in post hoc explanation methods under adversarial conditions, and directions for future
work on inherently interpretable architectures for continuous authentication.