eXIoT-IDS framework for trustworthy and actionable IoT intrusion detection

Abstract

In the ever-growing environment of Internet of Things (IoT), the use of deep learning in Intrusion Detection Systems (IDS) has delivered in detecting anomalies effectively. Despite this achievement, the technique has suffered setbacks due to the presence of “black box”. This nature in deep learning erodes security analysts’ trust and prevent timely action to be taken. In this work, eXIoT-IDS is introduced to breakdown model decisions that will foster trust, usability, and the actionability of intrusion alerts. The framework integrates a Multi-View Representation, Multi-Level Transformer (MVR-MLT) with an Explainable AI (XAI) for IoT systems. A user-centric Explanation Dashboard is designed from SHAP, attention visualization and counterfactual explanations. ToN-IoT dataset was used in some attack scenarios to validate the system by engaging 30 cybersecurity professionals to develop a-subject user group. From the results, the system developed revealed an improvement in completion of task in terms of speed, accuracy in alert generation, identification of attack, and severity assessment when compared with a baseline IDS. Also, a substantial increase in trust and perceived usability (SUS scores) were reported by the participants despite an overhead in computation introduced by the XAI components. This research work showcase the gains of deploying XAI in IoT security by enhancing the transparency and efficiency of cybersecurity operations.