eXIoT-IDS framework for trustworthy and actionable IoT intrusion detection

Emmanuel Onwuka Ibam; Ayobami Emmanuel Mesioye

doi:10.65112/tcmis.10034

Authors

Emmanuel Onwuka Ibam Department of Information Systems, Federal University of Technology, Akure, Nigeria https://orcid.org/0000-0003-0450-9034
Ayobami Emmanuel Mesioye Department of Cybersecurity, McPherson University, Seriki Sotayo, Nigeria https://orcid.org/0000-0003-0406-5226

DOI:

https://doi.org/10.65112/tcmis.10034

Keywords:

Deep learning, intrusion detection systems, explainable AI (XAI), transformer models

Abstract

In the ever-growing environment of Internet of Things (IoT), the use of deep learning in Intrusion Detection Systems (IDS) has delivered in detecting anomalies effectively. Despite this achievement, the technique has suffered setbacks due to the presence of “black box”. This nature in deep learning erodes security analysts’ trust and prevent timely action to be taken. In this work, eXIoT-IDS is introduced to breakdown model decisions that will foster trust, usability, and the actionability of intrusion alerts. The framework integrates a Multi-View Representation, Multi-Level Transformer (MVR-MLT) with an Explainable AI (XAI) for IoT systems. A user-centric Explanation Dashboard is designed from SHAP, attention visualization and counterfactual explanations. ToN-IoT dataset was used in some attack scenarios to validate the system by engaging 30 cybersecurity professionals to develop a-subject user group. From the results, the system developed revealed an improvement in completion of task in terms of speed, accuracy in alert generation, identification of attack, and severity assessment when compared with a baseline IDS. Also, a substantial increase in trust and perceived usability (SUS scores) were reported by the participants despite an overhead in computation introduced by the XAI components. This research work showcase the gains of deploying XAI in IoT security by enhancing the transparency and efficiency of cybersecurity operations.

Downloads

Download data is not yet available.

References

[1] H. Bhardwaj and S. Mahmood, "The role of Internet of Things (IoT), smart devices, and data integration in transforming business operations," Eur. Econ. Lett., vol. 15, no. 2, pp. 3035–3046, 2025, doi: 10.52783/eel.v15i2.3143. DOI: https://doi.org/10.52783/eel.v15i2.3143

[2] S. Fraihat, S. Makhadmeh, M. Awad, M. A. Al-Betar, and A. Al-Redhaei, "Intrusion detection system for large-scale IoT NetFlow networks using machine learning with modified arithmetic optimization algorithm," Internet of Things, vol. 22, Art. no. 100819, 2023, doi: 10.1016/j.iot.2023.100819. DOI: https://doi.org/10.1016/j.iot.2023.100819

[3] A. Thakkar and R. Lohiya, "A survey on intrusion detection system: Feature selection, model, performance measures, application perspective, challenges, and future research directions," Artif. Intell. Rev., vol. 55, pp. 453–563, 2022, doi: 10.1007/s10462-021-10037-y. DOI: https://doi.org/10.1007/s10462-021-10037-9

[4] G. Luo, Z. Chen, and B. O. Mohammed, "A systematic literature review of intrusion detection systems in the cloud-based IoT environments," Concurr. Comput. Pract. Exp., vol. 34, no. 15, Art. no. e6822, 2022, doi: 10.1002/cpe.6822. DOI: https://doi.org/10.1002/cpe.6822

[5] A. Alharthi, M. Alaryani, and S. Kaddoura, "A comparative study of machine learning and deep learning models in binary and multiclass classification for intrusion detection systems," Array, vol. 26, Art. no. 100406, 2025, doi: 10.1016/j.array.2025.100406. DOI: https://doi.org/10.1016/j.array.2025.100406

[6] B. E. Hommel, F. M. Wollang, V. Kotova, H. Zacher, and S. C. Schmukle, "Transformer-based deep neural language modeling for construct-specific automatic item generation," Psychometrika, vol. 87, no. 2, pp. 749–772, 2022, doi: 10.1007/s11336-021-09823-9. DOI: https://doi.org/10.1007/s11336-021-09823-9

[7] L. Nie, Z. Li, J. Liu, and Y. Zhang, "Transformer-based network intrusion detection: A survey," ACM Comput. Surv., vol. 56, no. 2, pp. 1–38, 2024, doi: 10.1145/3606839. DOI: https://doi.org/10.1145/3617680

[8] A. B. Arrieta et al., "Explainable Artificial Intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI," Inf. Fusion, vol. 58, pp. 82–115, 2020, doi: 10.1016/j.inffus.2019.12.005. DOI: https://doi.org/10.1016/j.inffus.2019.12.012

[9] V. Buhrmester, D. Münch, and K. A. [last name assumed], "Analysis of explainers of black box models in a responsible machine learning framework," ACM SIGKDD Explor. Newsl., vol. 23, no. 1, pp. 55–65, 2021, doi: 10.1145/3468501.3468510.

[10] A. Das and M. J. Nene, "Explainable AI for intrusion detection systems: A survey," ACM Comput. Surv., vol. 55, no. 5, pp. 1–36, 2022, doi: 10.1145/3544547. DOI: https://doi.org/10.1145/3539605

[11] R. Chinnasamy, M. Subramanian, E. Veerappampalayam, and J. Cho, "Deep learning-driven methods for network-based intrusion detection systems: A systematic review," ICT Express, vol. 11, pp. 181–215, 2025, doi: 10.1016/j.icte.2024.03.003. DOI: https://doi.org/10.1016/j.icte.2025.01.005

[12] V. Hnamte and J. J. Hussain, "Dependable intrusion detection system using deep convolutional neural network: A novel framework and performance evaluation approach," Telem. Inform. Rep., vol. 11, Art. no. 100077, 2023, doi: 10.1016/j.teler.2023.100077. DOI: https://doi.org/10.1016/j.teler.2023.100077

[13] Y. Zhang, L. Wu, and S. Wang, "Multi-task learning for enhanced security analytics: A review and taxonomy," IEEE Trans. Dependable Secur. Comput., vol. 19, no. 5, pp. 2890–2908, Sep.–Oct. 2022, doi: 10.1109/TDSC.2021.3079979.

[14] E. Gyamfi and A. Jurcut, "Intrusion detection in Internet of Things systems: A review on design approaches leveraging multi-access edge computing, machine learning, and datasets," Sensors, vol. 22, no. 10, Art. no. 3744, 2022, doi: 10.3390/s22103744. DOI: https://doi.org/10.3390/s22103744

[15] Y. Wang, Z. Han, J. Li, and X. He, "BS-GAT behavior similarity based graph attention network for network intrusion detection," 2023, arXiv:2304.07226. [Online]. Available: https://doi.org/10.48550/arXiv.2304.07226

[16] H. Kheddar, "Transformers and large language models for efficient intrusion detection systems: A comprehensive survey," preprint, arXiv:2408.07583, 2024. [Online]. Available: https://arxiv.org/abs/2408.07583v1

[17] F. Ullah, A. Turab, S. Ullah, D. Cacciagrano, and Y. Zhao, "Enhanced network intrusion detection system for Internet of Things security using multimodal big data representation with transfer learning and game theory," Sensors, vol. 24, no. 13, Art. no. 4152, 2024, doi: 10.3390/s24134152. DOI: https://doi.org/10.3390/s24134152

[18] J. Mao, X. Yang, B. Hu, Y. Lu, and G. Yin, "Intrusion detection system based on multi-level feature extraction and inductive network," Electronics, vol. 14, no. 1, Art. no. 189, 2025, doi: 10.3390/electronics14010189. DOI: https://doi.org/10.3390/electronics14010189

[19] O. Arreche, T. Guntur, and M. Abdallah, "XAI-IDS: Toward proposing an explainable artificial intelligence framework for enhancing network intrusion detection systems," Appl. Sci., vol. 14, no. 10, Art. no. 4170, 2024, doi: 10.3390/app14104170. DOI: https://doi.org/10.3390/app14104170

[20] R. Ahmed, R. A. Osman, and M. Amer, "Navigating urban congestion: A comprehensive strategy based on an efficient smart IoT wireless communication for PV powered smart traffic management system," PLOS ONE, vol. 19, no. 10, Art. no. e0310002, 2024, doi: 10.1371/journal.pone.0310002. DOI: https://doi.org/10.1371/journal.pone.0310002

[21] K. S. Adewole, A. Jacobsson, and P. Davidsson, "Intrusion detection framework for Internet of Things with rule induction for model explanation," Sensors, vol. 25, no. 6, p. 1845, 2025. DOI: https://doi.org/10.3390/s25061845

[22] N. Kaur and L. Gupta, "Securing the 6G–IoT environment: A framework for enhancing transparency in artificial intelligence decision-making through explainable artificial intelligence," Sensors, vol. 25, no. 3, Art. no. 854, 2025, doi: 10.3390/s25030854. DOI: https://doi.org/10.3390/s25030854