An Explainable LSTM-Based Intrusion Detection System Optimized by Firefly Algorithm for IoT Networks

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Internet of Things (IoT)

Background:

• Expanding IoT device connectivity increases cybercrime attack surfaces and security risks.
• Existing Intrusion Detection Systems (IDS) struggle with false positives and missed threats due to irrelevant data.
• AI-based IDSs often lack transparency, hindering understanding and adoption by cybersecurity professionals.

Purpose of the Study:

• To develop a transparent, deep learning-based IDS that adapts to new cyber threats.
• To address limitations of existing IDSs by reducing false positives and improving threat detection.
• To enhance cybersecurity by providing explainable AI (XAI) insights into model operations.

Main Methods:

• A hybrid approach combining statistical methods and a metaheuristic algorithm for optimal feature selection.
• Implementation of a Long Short-Term Memory (LSTM)-based deep learning model for intrusion detection.
• Utilized NF-BoT-IoT-v2 and IoTID20 datasets for model training and validation.
• Applied Local Interpretable Model-agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP) for model interpretability.

Main Results:

• Achieved high accuracy rates: 98.42% on the NF-BoT-IoT-v2 dataset and 89.54% on the IoTID20 dataset.
• Demonstrated superior performance compared to other machine learning models and existing state-of-the-art approaches.
• XAI tools provided valuable insights into the model's prediction mechanisms, increasing transparency.

Conclusions:

• The proposed deep learning model effectively enhances IoT security by accurately detecting intrusions.
• Feature selection and XAI integration improve IDS performance, transparency, and adoption in cybersecurity.
• The model offers a robust and understandable solution for identifying and mitigating cyber threats in IoT environments.