Real-time network intrusion detection system with two-stage ML (Isolation Forest + XGBoost), open-set escalation, SHAP explainability, Tier 2 LLM/RAG reasoning, and a live React dashboard.