Enhanced Intrusion Detection in IoT Networks: Leveraging Ensemble Learning and Explainable AI for Robust Security

Abstract

The proliferation of Internet of Things (IoT) technologies introduces major security challenges for large scale, heterogeneous, and resource constrained networks. Intrusion Detection Systems are essential to protect IoT environments from sophisticated attacks. This study evaluates the RT-IoT2022 dataset using K-Nearest Neighbors, Support Vector Machine, Decision Tree, Gradient Boost, XGBoost, Random Forest, Extra Trees, and LightGBM models. Feature selection with SMOTEENN sampling is applied to handle class imbalance and improve robustness. A Voting Classifier ensemble integrating Random Forest, Extra Trees, and LightGBM achieves the best results, reaching 99.9% accuracy, precision, recall, and F1 score, outperforming all standalone algorithms. Explainable AI techniques, including LIME and SHAP, are incorporated to interpret feature influence and enhance trust in predictions. For real time deployment, the optimized ensemble is implemented using a Flask based web application enabling interactive intrusion detection. The system classifies traffic into attack categories such as DoS_SYN_Hping, Thing_Speak, ARP_Poisoning, MQTT_Publish, NMAP_UDP_SCAN, NMAP_XMAS_TREE_SCAN, NMAP_OS_DETECTION, NMAP_TCP_SCAN, DDoS_Slowloris, Wipro_bulb, Metasploit_Brute_Force_SSH, NMAP_FIN_SCAN. The proposed framework delivers accurate, interpretable, and scalable intrusion detection suitable for next generation IoT security monitoring environments under dynamic real world threat conditions.