An interpretable deep learning framework for intrusion detection in industrial Internet of Things

Abstract

The Industrial Internet of Things (IIoT) has revolutionized smart industries by optimizing industrial operations and accelerating the decision-making process. However, its inherently distributed architecture presents complex and evolving security threats. Traditional machine learning (ML) and deep learning (DL)-based intrusion detection systems (IDSs) often lack interpretability, which undermines their trustworthiness in critical IIoT environments. To overcome these limitations, we propose XGRU-IDS, an explainable hybrid DL-based IDS that combines the strengths of the Extra Trees Classifier (ETC) for feature selection and Gated Recurrent Units (GRU) for sequential attack detection. The ETC enhances model input quality by identifying the most influential features, while the GRU processes temporal dependencies to detect sophisticated intrusion patterns. Explainability is ensured through SHapley Additive exPlanations (SHAP), which offer class-wise insights via summary plots, feature importance scores, and force plots. XGRU-IDS is evaluated on the multiclass CICIoT2023 dataset, which covers all 34 attack types. It achieves 97.56% accuracy, outperforming recent state-of-the-art DL and explainable IDS approaches. This work demonstrates that high detection accuracy can coexist with transparency, providing a robust and trustworthy IDS solution for resource-constrained IIoT networks.