Deep Learning-Based Intrusion Detection System for IoT Networks with Explainability

Abstract

The recent onset of many IoT devices being connected leaves highly computing-equipped systems susceptible to attacks, calling for an explicit intelligent security measure that could strategically find the root cause and pattern types of security intrusion. Thus, this paper aims to propose a novel deep learning based neural network model for intelligent and automatic intrusion detection IoT capable enough to detect & classify almost every kind of malicious activity with near-perfect accuracy. This research introduces the analysis of network traffic patterns to differentiate legitimate and attack behaviors such as DDoS, malware, and spoofing attacks using CNN and LSTM models. SHAP and LIME are two explainability techniques that turn the black-box nature of deep learning into a white-box, providing insights into decision-making with complete transparency for security analysts using this model. The resulting system is assessed with BOT-IoT and CICIDS2017 IoT datasets for high detection with significantly fewer false positives, both in terms of detection result accuracy and ratio that can be used as a real-time, feasible solution further into the resource-scarce environment or condition of the IoT. Furthermore, it is also highly resistant against zero-day attacks due to its native continuous learning features. The IDS combines the power of high-performance deep learning with explainable AI to improve threat detection and trust and usability for IoT security operations. These results highlight the potential applicability and interpretability of SCADNet as a general-purpose security solution that can enter the infinite space of more complex IoT threatful networks.