Enhancing IoT network security with explainable deep learning-based intrusion detection systems

Area of Science:

• Cybersecurity
• Internet of Things (IoT)
• Machine Learning

Background:

• Deploying intrusion detection systems (IDS) on low-power IoT devices presents challenges due to resource constraints.
• Existing neural network solutions often lack the efficiency and transparency required for edge computing.

Purpose of the Study:

• To introduce a lightweight and explainable IDS tailored for resource-limited IoT environments.
• To evaluate the performance of a novel IDS against traditional models for IoT intrusion detection.

Main Methods:

• A 1D-Convolutional Neural Network (1D-CNN) was combined with SHapley Additive exPlanations (SHAP) for spatial feature analysis and model interpretation.
• Comparative analysis against traditional Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) models using real-world datasets (UNSW-NB15 and WUSTL-IIoT-2021).

Main Results:

• The SHAP-augmented 1D-CNN outperformed benchmark CNN and LSTM models in IoT intrusion detection.
• SHAP analysis facilitated feature reduction, leading to streamlined models that maintained over 93% F1-score.
• Computational overhead was reduced by over 38%, enabling millisecond-level inference on edge hardware.

Conclusions:

• The proposed lightweight, explainable IDS effectively balances high detection accuracy with the stringent resource limitations of IoT devices.
• This approach offers a practical solution for deploying robust cybersecurity measures on edge hardware.
• The findings pave the way for more efficient and transparent intrusion detection in IoT ecosystems.