Machine Learning Explainability for Intrusion Detection in the Industrial Internet of Things

Abstract

Intrusion and attacks have consistently challenged the Industrial Internet of Things (IIoT). Although artificial intelligence (AI) rapidly develops in attack detection and mitigation, building convincing trust is difficult due to its black-box nature. Its unexplained outcome inhibits informed and adequate decision-making of the experts and stakeholders. Explainable AI (XAI) has emerged to help with this problem. However, the ease of comprehensibility of XAI interpretation remains an issue due to the complexity and reliance on statistical theories. This study integrates agnostic post-hoc LIME and SHAP explainability approaches on intrusion detection systems built using representative AI models to explain the model's decisions and provide more insights into interpretability. The decision and confidence impact ratios assessed the significance of features and model dependencies, enhancing cybersecurity experts' trust and informed decisions. The experimental findings highlight the importance of these explainability techniques for understanding and mitigating IIoT intrusions with recourse to significant data features and model decisions.