Search papers, labs, and topics across Lattice.
This study evaluates the interplay between predictive accuracy and explanation metrics in IoT intrusion detection, highlighting the importance of explanation cost, stability, and utility. Using a newly constructed CICIoT2023 corpus, the authors assessed various machine learning models, including XGBoost and Random Forest, revealing that while XGBoost excelled in predictive performance, Random Forest offered superior explanation stability and lower false-positive rates. The findings indicate that effective explainable intrusion detection requires a balance of predictive quality and computational efficiency, challenging the conventional focus on accuracy alone.
Operationally useful explainable IoT intrusion detection hinges on a delicate balance of predictive quality, explanation cost, and stability, not just accuracy.
Machine-learning intrusion-detection studies commonly emphasize predictive accuracy while treating explanation generation as a computationally free post-processing step. This study jointly evaluates predictive effectiveness, explanation cost, local explanation stability, and selective explanation for binary Internet of Things (IoT) intrusion detection. A leakage-safe CICIoT2023 corpus was constructed using exact 39-feature hashes, non-finite-value handling, exact-feature deduplication, conservative label-collision removal, and deterministic hash-level partitioning. Logistic Regression, Decision Tree, Random Forest, and XGBoost were evaluated on natural and balanced test distributions. TreeSHAP cost was measured, stability was assessed under prediction-preserving perturbations, and validation-calibrated policies were used to allocate explanation workload. XGBoost provided the strongest overall predictive profile, while Random Forest produced the lowest false-positive rate. At 5,000 samples, TreeSHAP required 700.759 s for Random Forest and 1.471 s for XGBoost. Random Forest showed the strongest overall base-level explanation stability; XGBoost retained high rank and directional consistency but showed greater top-feature turnover and attribution-magnitude drift. On the balanced test, about 90% false-negative explanation coverage permitted 28-32% compute savings, while about 95% coverage permitted 15-23% savings. Savings were much smaller under the attack-heavy natural prevalence. These results show that operationally useful explainable IoT intrusion detection depends on predictive quality, explanation cost, local stability, workload prevalence, and selective invocation rather than detection accuracy alone.
