Explainable Artificial Intelligence for Cyberattack Detection in Industrial IoT Environments

Abstract

The growth of Industrial Internet of Things (IIoT) has greatly increased the attack surface against critical infrastructure such as manufacturing, energy and transportation systems. While machine learning (ML) intrusion detection systems (IDS) are accurate, they are opaque and thus difficult for operators to trust or comply with regulations. So In this paper, an Explainable AI (XAI) enhanced framework for cyberattack detection in IIoT networks is proposed. We perform ensemble learning models: Random Forest (RF) and Extreme Gradient Boosting (XGBoost) and apply SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME) as post-hoc explainability techniques for two publicly available benchmark datasets: Edge-IIoTset and CICIoT2023. Experimental results shows that XGBoost model is capable of 98.9% detection accuracy and 99.2% F1 score in 14 attack categories. SHAP selects the most discriminative traffic features for each attack class, and LIME generates instance-level explanations of the decisions to be made by a non-expert operator. Finally, by closing the transparency gap in the security of the IIoT, the proposed XAI-IDS framework will allow for threat intelligence that is both actionable and human-readable, while no compromising the detection performance. The results serve as a repeatable reference point for future studies in industrial cybersecurity that can be trusted.