Enhancing IoT botnet detection with explainable ensemble learning

Abstract

Introduction Internet of Things (IoT) botnet detection faces significant challenges due to the growing intricacy and decreased transparency of Machine Learning (ML) models. Methods In this work, we provide an ensemble-based detection system that makes use of a voting classifier made up of a Boosted Decision Tree and a Bagged Random Forest. Using manual feature extraction, the model is trained and assessed using the N-BaIoT dataset. The popular Explainable AI (XAI) method, SHapley Additive exPlanations (SHAP), is used to analyze feature contributions across models while taking important factors like consistency, sensitivity, and monotonicity into account in order to improve the interpretability of the features. SHAP eases the black-box characteristic of sophisticated machine learning models by quantifying the influence of specific features, hence facilitating transparent model interpretation. Results According to experimental data, the ensemble model is more sensitive than individual classifiers. Additionally, dynamic changes in SHAP values are shown by the weight adjustments made within the voting classifier, highlighting the impact of weight tuning on feature importance. Discussion This study highlights the effectiveness of integrating SHAP-based XAI into ensembled models, enhancing the transparency, interpretability, and reliability of IoT botnet detection systems.