Attention integrated deep learning models for interpretable multi-class IoT intrusion detection using SHAP

The rapid growth of the Internet of Things (IoT) has increased the size, complexity, and vulnerability of network traffic, making intrusion detection a critical factor of modern cybersecurity. Traditional intrusion-detection systems (IDSs) analyze handcrafted features and rules to detect emerging attack patterns. To address these limitations, deep learning frameworks, such as attention-enhanced one-dimensional (1D) Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and Gated Recurrent Unit (GRU), are analyzed for accurate and efficient multi-class attack detection. The proposed attention-enhanced 1D convolutional layers extract discriminative spatial features while focusing on the most relevant patterns within the network flow. The LSTM and GRU architectures analyzed long-range temporal dependencies present in sequential traffic data, enabling robust identification of subtle anomalies. The model was evaluated on two datasets: Hacking and Countermeasure Research Lab (HCRL) and the Kitsune IoT datasets, which represent diverse real-world benign and malicious traffic conditions. Experimental results demonstrate that the attention-enhanced 1D CNN achieved the highest performance of 98 and 87% on the Kitsune and HCRL datasets, respectively. SHapley Additive exPlanations (SHAP) based interpretability analysis shows how individual features contribute to predictions, highlighting the most significant features driving intrusion-detection decisions. The results confirm that incorporating attention mechanisms significantly enhances the discriminative capability, enabling more reliable classification of complex IoT attack types. The proposed approach effectively addresses key challenges in IoT intrusion detection by combining spatial and temporal deep learning components for deployment in intelligent real-time IoT network security systems.