Explainable AI-based intrusion detection in IoT systems

Abstract

The Internet of Things (IoT) systems are highly vulnerable to cyber attacks due to limited and/or default security measurements. Machine learning (ML) techniques bring a powerful weapon against the insecurities of IoT systems, such as intelligent intrusion detection systems (IDSs), vulnerability/threats detection, and behavioral analysis. ML-based IDSs offer a significant improvement in IoT security, but they also bring technical challenges, e.g., false positives, evolving attacks, data quality and bias, explainability and transparency, etc. Explainable Artificial Intelligence (XAI) can address these challenges by offering interpretable and comprehensible insights into the ML-based IDS decision-making process. A novel framework for an explainable IDS-based vulnerable IoT devices related to the Ripple20 vulnerability and its associated attacks. The framework integrates ML classifiers and XAI techniques to provide comprehensive and interpretable explanations for the IDS decisions. We evaluated this framework on various datasets, including a dataset collected from the labs and other public datasets, using binary and multi-classification models. The experimental results demonstrate the efficiency and accuracy of the framework in detecting and categorizing IoT vulnerabilities. The framework also offers benefits over conventional IDS systems, such as facilitating comprehension and confidence among security experts, enhancing the precision and efficiency of the detection procedure, and adapting to the dynamic IoT environment.