An Explainable and Verifiable Intrusion Detection Framework for IoMT: Triple-Validation With Confounding Variable Analysis and Grade-Based Alert Monitoring

Abstract

Intrusion detection systems for the Internet of Medical Things (IoMT) increasingly rely on explainable artificial intelligence (XAI) to justify their predictions. Yet techniques such as SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) can present features as important that in fact lack statistical discriminative power, a risk that is particularly acute in IoMT environments where detection evidence shapes both security response and clinical judgment. This paper proposes a Triple-Validation framework that inserts a Cohen’s d gatekeeper between SHAP and LIME, confirming a feature as reliable evidence only when it shows a statistically meaningful effect size and independently appears in the sample’s local explanation. Building on this, detection outcomes are graded to automatically determine alert response priority for security operations centers. The framework is evaluated on two structurally distinct datasets, WUSTL-EHMS-2020, which includes biosignals, and CICIoMT-2024, specialized for IoMT packet traffic, with XGBoost as the base classifier. Experiments show that SHAP-identified features, including body temperature in WUSTL and packet inter-arrival time in CICIoMT, are statistically non-discriminative confounders. Notably, IAT still appears in LIME explanations despite failing the Cohen’s d test, confirming that SHAP and LIME alone cannot filter such variables. In turn, a class-level analysis of combining biomedical and network features shows that the performance gain prior binary classification studies reported only in aggregate is in fact concentrated in the spoofing class, where the F1-score rises from 0.7962 to 0.8848. In practice, a prototype monitoring dashboard shows that the proposed grading scheme can be implemented in a form suitable for security operations use.