An Explainable AI-Driven Intrusion Detection Framework for IoT Networks Using Deep Learning and Machine Learning Models

Abstract

The Internet of Things (IoT) has seen a tremendous growth in the number of its devices and, consequently, the IoT networks are also very susceptible to the powerful cyberattacks, otherwise it's too easy! Traditional Intrusion Detection Systems (IDSs) cannot work very efficiently if new attacks appear, and they are not very effective in interpreting the prediction results even if they appear on paper to be accurate. This study introduces a new intrusion detection system (IDS) based on Explainable Artificial Intelligence (XAI), where machine learning and deep learning are stitched together in a way that boosts detection accuracy, and at the same time gives transparency to the model behaviour. The proposed framework is validated with six different machine learning classification models namely Decision Tree, Random Forest, XGBoost, Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM) and Transformer. The work of evaluation is conducted on two benchmark datasets, CICIoT2023 and IoT-23, the datasets are preprocessed and normalized using the selected features, and the datasets are divided into training and testing sets afterwards, thus bringing the learning process under control. The developed approaches are evaluated using metrics such as Accuracy, Precision, Recall, F1-score, ROC-AUC, Confusion Matrix and Inference Time. Furthermore, the integration of In addition, SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) is integrated, for global and local rationales of model predictions. The overall experimental results show that the LSTM model is the most accurate and achieves the highest accuracy of 96% with an F1 score of 95% and a ROC–AUC of 0.97. Overall, these results outperform the other traditional machine learning baselines as well as the other deep learning models. Also, the explainability analysis largely validated that SHAP and LIME can identify the most crucial network traffic features, thereby enhancing the transparency and trustworthiness of the entire intrusion detection system, even with the complexity involved. The overall findings suggest that deep learning in conjunction with XAI is a viable and understandable method for protecting modern IoT environment against those fresh, incoming cyber threats.