SHAP-Guided Feature Selection for IoT Botnet Detection: A Comparative Study with Conventional Methods

Abstract

The widespread deployment of Internet of Things (IoT) devices has expanded the attack surface of modern networks, making IoT botnets a persistent cybersecurity threat. Although machine learning-based intrusion detection systems (IDSs) have demonstrated promising detection capability, their performance is often hindered by redundant high-dimensional features and limited model interpretability. This study presents an explainability-guided feature selection framework that employs SHAP values derived from an XGBoost model to rank features and systematically compares its effectiveness with Mutual Information (MI), Analysis of Variance (ANOVA), and Principal Component Analysis (PCA) across nine machine learning classifiers using the N-BaIoT dataset. Experimental results indicate that LightGBM with SHAP-selected features achieves an accuracy of 0.9994 using only the top 10 features. Among the evaluated feature selection methods, SHAP achieves the highest classification performance on seven of the nine classifiers, while Wilcoxon signed-rank tests indicate a statistically significant difference between SHAP and ANOVA (p = 3.03 × 10−5); the difference between SHAP and MI is significant at the conventional threshold (p = 2.86 × 10−2) but does not remain significant after Bonferroni correction for multiple comparisons. Furthermore, SHAP-based analysis reveals distinct traffic statistical signatures between the Mirai and Gafgyt botnet families, offering actionable insights for explainability-aware IoT intrusion detection. The proposed framework provides a practical solution for balancing detection performance and model interpretability in IoT botnet detection.