The increasing sophistication of cyber-attacks has exposed limitations in traditional signature-based Intrusion
Detection Systems (IDS), particularly in detecting unseen
threats while controlling false alarms. This paper presents an explainable AI-based IDS benchmarked on the CICIDS2017
dataset using a unified preprocessing and evaluation
framework. We compare Random Forest, XGBoost, and a lightweight one-dimensional Convolutional Neural Network
(1D-CNN) under the same conditions, with the false-positive
rate being the most important operational metric. The 1D-CNN
has a 96.34% accuracy, a 96.67% recall, and a 3.01% falsepositive rate, which is better than the classical machine learning baselines. To boost analyst trust, feature-importance analysis is used to show flow duration, packet statistics, and protocol anomalies as the main signs of bad behavior. The proposed modular architecture is compatible with SIEM, SOAR, and Zero-Trust frameworks, showing that it can be used in realworld businesses.