XAI-Driven Intrusion Detection for Internet of Things Networks

Abstract

Systems that can reliably detect intrusion are increasingly in demand as the scale and heterogeneity of Internet of Things (IoT) networks rise. However, when strong tabular models are employed as a benchmark, it is not clear whether the complexity of ensembling actually pays off. The aim of this work is to systematically assess the reliability and accuracy of soft-voting ensembles across three benchmark datasets (CICIoT2023, TON_IoT, and Edge-IIoTset), applying a leakage-free protocol with twice-repeated stratified 10-fold cross-validation. Ensembles of varying sizes and compositions were benchmarked against Decision Tree, KNN, Random Forest, LightGBM, XGBoost, and CatBoost and the results revealed that ensemble complexity did not lead to a consistent increase in performance. For example, SoftVote-2 increased macro-F1 over LightGBM on CICIoT2023 from 0.8506 to 0.8563, whereas LightGBM remained superior on TON_IoT and Edge-IIoTset. A leakage analysis demonstrated that resampling before data partitioning increased accuracy by around 8 percentage points and macro-F1 by 14 to 17 percentage points. To assess the trade-off between performance and complexity, training time, inference latency, memory, and model size were all evaluated, and LIME and SHAP were also assessed for explanation stability, local fidelity, and attribution agreement. XAI-guided feature selection showed that the 15 most important features retained 98.4–99.4% of the original macro-F1 and decreased inference latency by up to 38%. The results indicate that the value of ensemble complexity varies by dataset and should be weighed against its computational cost. The main contribution of this study is a leakage-aware and explainability-informed framework that can be used to judge when ensemble complexity yields genuine predictive and practical benefits for the detection of IoT intrusion.