ANOMALY DETECTION IN INTERNET OF THINGS NETWORKS USING EXPLAINABLE DEEP LEARNING TECHNIQUES

Abstract

The proliferation of the Internet of Things (IoT) brings about increasing interconnectivity of smart environments including homes, healthcare, manufacturing, transportation, and other cyber-physical systems, but at the same time poses new challenges for network security and integrity. This paper proposes an explainable deep learning based method for detecting anomalies in the traffic of IoT networks. The CICIoT2023, Canadian Institute for Cybersecurity Internet of Things 2023 dataset is used, which was curated by the Canadian Institute for Cybersecurity. The method consists of data preprocessing steps, including categorical encoding, normalization, and balancing, followed by the utilization of the GRU type recurrent neural network for classification. This architecture was selected due to its ability to learn long-term temporal patterns and process the given sequences of traffic data. The paper also evaluates the model using SHapley Additive exPlanations (SHAP) values for interpretability, providing a glimpse into the inner workings of the otherwise complex black-box model, thus allowing for targeted traffic feature inspection crucial for network traffic analysis. Various performance assessment criteria are considered, including accuracy, precision, recall, F1-score, confusion matrix, training and validation convergence, inference acceleration, and instance-specific explanation. The implementation results in the paper demonstrate that the given approach can reach 97.56% accuracy, 97.41% precision, 97.56% recall, and 97.42% F1-score on the given task, thus successfully balancing between the high-performance intrusion detection and the needed degree of interpretation. The paper concludes that the combination of GRU driven temporal processing and SHAP driven explanation is a viable option for modern networks.

DOI: https://doi.org/10.5281/zenodo.23122642