Izvorni znanstveni članak

https://doi.org/10.17559/TV-20250720002849

An Interpretable Intrusion Detection Approach for IoT Using Graph Attention Networks and Transformer Models with Balanced Learning

J. Wilson ; Department of IT, SSM Institute of Engineering and Technology, Dindigul, India *
Abhijit P. Deshpande ; Board of Constituents and University Development, Symbiosis International (Deemed University)
M. Premkumar ; Department of Artificial Intelligence and Data Science, SSM Institute of Engineering and Technology, Dindigul, India
T. Yuvaraja ; Department of ECE, Kongunadu College of Engineering and Technology, Thottiyam, India

* Dopisni autor.

Sažetak

Intrusion Detection Systems (IDSs) in Internet of Things (IoT) environments face persistent challenges, including class imbalance in network traffic data and the limited interpretability of black-box machine learning models. This paper proposes a novel, interpretable framework that effectively addresses both concerns. We introduce a Diffusion Model-based Synthetic Data Generator (DM-SDG) coupled with Prototype-Based Undersampling (PBUS) to mitigate class imbalance issues without compromising data integrity. For enhanced feature selection and dimensionality reduction, a dual-stage feature refinement strategy is employed using Self-Supervised Feature Filtering (SSFF) and SHAP-Guided Recursive Pruning (SGRP). Our classification stage incorporates Graph Attention Networks (GATs) and Transformer-based Intrusion Detection Systems (T-IDS), which provide improved context-awareness and sequence modeling in dynamic IoT environments. To enhance transparency and model trustworthiness, we integrate three explainability mechanisms: Counterfactual Explanations (CE), SHAP Interaction Values, and Explainable Concept Activation Vectors (ECAVs), enabling both global and local interpretation of detection decisions. The proposed solution is evaluated on benchmark datasets including CICIDS2018, CIC-ToN-IoT, and NF-UNSW-NB15-v2. Experimental results demonstrate accuracy improvements ranging from 0.5% to 2.4%, along with consistent F1-score and MCC gains of 1.5-3.5% over leading baselines such as CTGAN-ENN. Our framework achieves a balanced trade-off between detection accuracy, computational efficiency, and explainability, making it highly suitable for deployment in real-time IoT security infrastructures.

Ključne riječi

explainable artificial intelligence; graph attention network; internet of things (IoT); intrusion detection system; transformer-based model

Hrčak ID:

346717

URI

https://hrcak.srce.hr/346717

Datum izdavanja:

30.4.2026.

Posjeta: 0 *