Transparent Deep Learning for Emerging Cyberattack Detection in IoT Networks

Abstract

Internet of Things (IoT) intrusion-detection systems must identify heterogeneous and previously unseen attacks while producing explanations that security analysts can inspect. This study develops a compact and explainable CNN–BiLSTM framework for known-attack classification and leave-one-attack-out evaluation using NSL-KDD, CICIDS2017, and UNSW-NB15. The processing pipeline comprises data cleaning, categorical encoding, normalization, Mutual Information feature selection, Principal Component Analysis (PCA), Conv1D feature extraction, BiLSTM dependency modelling, Softmax classification, and post-hoc SHAP explanation. The held-out Botnet class in CICIDS2017 and the held-out Exploits class in UNSW-NB15 are evaluated separately as binary attack-versus-benign scenarios because their original multiclass labels are absent during training. The reported known-attack accuracies are 99.1%, 99.4%, and 98.7% on NSL-KDD, CICIDS2017, and UNSW-NB15, respectively, with ROC-AUC values of 0.995, 0.997, and 0.992. The previously reported pooled leave-one-attack-out result is 98.2% accuracy, a 97.9% detection rate, and a 2.3% false-positive rate; the revised protocol requires separate per-held-out-class sample counts and metrics before the zero-day evidence can be interpreted conclusively. The findings support the feasibility of combining compact hybrid classification with transparent post-hoc explanation, while the revised study distinguishes predictive performance from SHAP interpretation and defines the additional evidence required for reproducible unseen-attack evaluation.