Explainable Artificial Intelligence Based Anomaly Detection for Internet of Things

Abstract

The Internet of Things (IoT) ecosystem is rapidly increasing, with billions of interconnected devices exchanging vast amounts of data daily. This expansion has made ensuring the security and reliability of IoT systems increasingly critical. In this context, anomaly detection is critical because it allows for the identification of unexpected patterns or malicious behaviors that could risk device functionality, compromise data integrity, or threaten user privacy. Despite its importance, effective anomaly detection in IoT systems faces challenges due to the diverse nature of IoT devices, their limited resources, and the large volume and variability of the generated data. Overcoming these challenges requires not only accurate detection mechanisms but also models that provide transparency and build trust among users and stakeholders. To address this problem, this thesis proposes an approach that combines Explainable Artificial Intelligence (XAI) techniques with traditional Machine Learning (ML) methods to enhance anomaly detection in IoT systems. A three-phase methodology is being implemented using the NSL-KDD dataset. In the first phase, the performance metrics of the models such as accuracy, f1-score, precision and recall are obtained by applying the classical ML methods such as Naive Bayes (NB), Decision Tree (DT), K-Nearest Neighbors (KNN), Logistic Regression (LR), Random Forest (RF), Extreme Gradient Boosting (XGBoost), Deep Neural Network (DNN). In the second phase, the same performance metrics of the models are obtained by using the most effective 10 features determined by the Feature Selection (FS) methods such as SelectKBest, Pearson Correlation, Chi-Squared, Information Gain, Recursive Feature Elimination. In the last phase, the feature set determined by the XAI methods and the feature set determined by the FS methods are combined, and the success rates of each model are observed in order to observe the effect of XAI. As a result, it is concluded that higher success rates were obtained when XAI was included. This demonstrates that integrating XAI with FS methods not only improves detection accuracy but also enhances the interpretability and trustworthiness of anomaly detection systems, highlighting the vital role of XAI in securing IoT environments against evolving threats.