Jove
Visualize
Contact Us
JoVE
x logofacebook logolinkedin logoyoutube logo
ABOUT JoVE
OverviewLeadershipBlogJoVE Help Center
AUTHORS
Publishing ProcessEditorial BoardScope & PoliciesPeer ReviewFAQSubmit
LIBRARIANS
TestimonialsSubscriptionsAccessResourcesLibrary Advisory BoardFAQ
RESEARCH
JoVE JournalMethods CollectionsJoVE Encyclopedia of ExperimentsArchive
EDUCATION
JoVE CoreJoVE BusinessJoVE Science EducationJoVE Lab ManualFaculty Resource CenterFaculty Site
Terms & Conditions of Use
Privacy Policy
Policies

Related Experiment Videos

An Explainable XGBoost-Based Framework for IoT Attack Detection with Unseen Attack Family Evaluation.

Ruei-Jan Hung1

  • 1Department of Electronic Engineering, Cheng Shiu University, Kaohsiung 833301, Taiwan.

Sensors (Basel, Switzerland)
|May 27, 2026
PubMed
Summary

Related Concept Videos

You might also read

Related Articles

Articles linked to this work by shared authors, journal, and citation graph.

Sort by
Same journal

RETRACTED: Ndaguba et al. Operability of Smart Spaces in Urban Environments: A Systematic Review on Enhancing Functionality and User Experience. <i>Sensors</i> 2023, <i>23</i>, 6938.

Sensors (Basel, Switzerland)·2026
Same journal

Correction: Ma et al. A Lightweight, Low-Frequency, Broadband Underwater Acoustic Transducer with Ternary Symmetric Excitation: Integrating KNN and Terfenol-D for Enhanced Performance. <i>2026</i>, <i>26</i>, 3645.

Sensors (Basel, Switzerland)·2026
Same journal

Correction: He et al. An Edge-Computing-Based Emotion-Aware Adaptive Lighting System for Intelligent Cockpits. <i>Sensors</i> 2026, <i>26</i>, 3489.

Sensors (Basel, Switzerland)·2026
Same journal

Correction: Tu et al. Lower Limb Motion Recognition with Improved SVM Based on Surface Electromyography. <i>Sensors</i> 2024, <i>24</i>, 3097.

Sensors (Basel, Switzerland)·2026
Same journal

Real-Time Detection System for Road Roughness Based on Ultrasonic Technology.

Sensors (Basel, Switzerland)·2026
Same journal

FedHSFV: Federated Learning for Finger Vein Recognition via Hierarchical Decoupling and Subspace Metric.

Sensors (Basel, Switzerland)·2026

This study introduces an explainable XGBoost framework for Internet of Things (IoT) intrusion detection, evaluating performance against unseen attacks. Optimized XGBoost offers a scalable, low-false-alarm solution, while Random Forest excels at minimizing missed attacks.

Area of Science:

  • Cybersecurity
  • Machine Learning
  • Internet of Things (IoT)

Background:

  • The proliferation of Internet of Things (IoT) devices presents significant cybersecurity challenges due to their heterogeneity and limited security capabilities.
  • Existing machine learning approaches for IoT intrusion detection often lack robust evaluation, fair comparisons, and explainability, particularly for unseen threats.

Purpose of the Study:

  • To propose an explainable XGBoost-based framework for detecting IoT attacks, including evaluation against unseen attack families.
  • To conduct a fair comparison of seven representative machine learning models under consistent training budgets and evaluation protocols.

Main Methods:

  • Utilized the large-scale CICIoT2023 dataset for binary classification of benign vs. malicious IoT traffic.
  • Implemented two evaluation protocols: closed-world cross-validation and zero-day-like unseen attack family evaluation.
Keywords:
Internet of ThingsIoT attack detectionXAIanalyst-centered explanationexplainable artificial intelligenceintrusion detectionunseen attack family evaluation

Related Experiment Videos

  • Employed a fair-budget experimental design and integrated SHapley Additive exPlanations (SHAP) for model interpretability.

    • Main Results:

    • Tree-based ensembles outperformed linear and shallow neural network baselines in closed-world settings, with Random Forest achieving the highest macro-F1.
    • In unseen attack scenarios, Random Forest offered higher recall but also a higher false alarm rate (FAR), while optimized XGBoost provided a lower FAR.
    • Threshold calibration demonstrated that Random Forest excels in recall-oriented detection, whereas optimized XGBoost offers a competitive low-FAR operating point.

    Conclusions:

    • The choice between Random Forest and optimized XGBoost depends on deployment priorities: Random Forest for minimizing missed attacks, optimized XGBoost for explainable, low-FAR, and scalable intrusion detection.
    • Explainability analysis highlighted the importance of TCP control-flag, temporal, and packet-statistical features for the XGBoost model.