Enhancing IoT network security with explainable deep learning-based intrusion detection systems.
TL;DR
A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.
Abstract
Deploying effective intrusion detection systems on low-power IoT devices requires a careful balance of performance, efficiency, and transparency. Current neural-network-based solutions are often too resource-intensive and opaque for practical edge use. We introduce a lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation. To the best of our knowledge, this work presents the first comparative analysis of a SHAP-augmented 1D-CNN against traditional CNN and LSTM models for IoT intrusion detection. Our method outperforms these benchmarks on real-world datasets (UNSW-NB15 and WUSTL-IIoT-2021). Crucially, SHAP analysis enables feature reduction, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware. These results demonstrate a viable path for reconciling high detection accuracy with the stringent resource limitations of IoT environments.