Bridging Explainability and Security: An XAI-Enhanced Hybrid Deep Learning Framework for IoT Device Identification and Attack Detection

Abstract

The rapid expansion of the Internet of Things (IoT) has made accurate and interpretable device identification essential for maintaining network security, managing traffic, and enforcing security policies. However, traditional identification methods, often reliant on handcrafted features or shallow models, struggle to adapt to the highly dynamic and heterogeneous nature of modern IoT environments. They also offer limited transparency, making it difficult for analysts to trust or understand their decisions. To address these challenges, we propose a hybrid machine learning framework that combines deep feature extraction using Convolutional Neural Networks (CNNs) with the robust classification capabilities of XGBoost. This design eliminates the need for manual feature engineering and enhances detection accuracy by learning directly from raw packet-level network data. To ensure interpretability, which is critical in security-sensitive applications, we integrate Explainable AI (XAI) techniques using SHAP values. These explanations help identify the key features that influence each classification decision, increasing trust, and supporting informed actions. We evaluated the proposed system using the CIC IoT2024-DIAD dataset, which includes traffic data from seven device classes and 25 network features. The model achieved strong performance across multiple metrics: 99.92% accuracy, 99.97% F1-Score, 99.62% precision, 99.13% recall, and 99.27% specificity. Regularization and dropout layers were used to mitigate overfitting and ensure generalizability. Unlike existing solutions, our framework balances high accuracy with real-time interpretability, making it scalable, lightweight, and suitable for deployment in resource-constrained IoT settings.

Topics & Concepts