An Explainable Ensemble Deep Learning Approach for Intrusion Detection in Industrial Internet of Things

Abstract

Ensuring the security of critical Industrial Internet of Things (IIoT) systems is of utmost importance, with a primary focus on identifying cyber-attacks using Intrusion Detection Systems (IDS). Deep learning (DL) techniques are frequently utilized in the anomaly detection components of IDSs. However, these models often generate high false-positive rates, and their decision-making rationale remains opaque, even to experts. Gaining insights into the reasons behind an IDS's decision to block a specific packet can aid cybersecurity professionals in assessing the system's effectiveness and creating more cyber-resilient solutions. In this paper, we offer an explainable ensemble DL-based IDS to improve the transparency and robustness of DL-based IDSs in IIoT networks. The framework incorporates Shapley additive explanations (SHAP) and Local comprehensible-independent Clarifications (LIME) methods to elucidate the decisions made by DL-based IDSs, providing valuable insights to experts responsible for maintaining IIoT network security and developing more cyber-resilient systems. The ToN_IoT dataset was used to evaluate the efficacy of the suggested framework. As a baseline intrusion detection system, the extreme learning machines (ELM) model was implemented and compared with other models. Experiments show the effectiveness of ensemble learning to improve the results. INDEX TERMS explanation AI (XAI); intrusion detection systems (IDS); SHapley Additive explanations (SHAP), Local Comprehensible Model-independent Clarifications (LIME), Ensemble Learning, CNN.

A Survey on Key Agreement and Authentication Protocol for Internet of Things Application

“…Attack graphs combined with other methods, such as game theory and machine learning, help assess the vulnerability of IoT networks [103]. Recent research focuses on using deep learning methods to design malware detection systems [104]. HSAS-MD Analyzer [105] employs a combination of modelchecking technique (MCT) and deep learning (DL), particularly a convolutional neural network (CNN) model, to analyze and detect potential threats for IoT applications, which shows the best performance compared with other security analysis systems.…”