Explainable Federated Learning for Botnet Detection in IoT Networks

The widespread use of Internet of Things (IoT) de-vices has increased the vulnerability to botnet attacks, presenting significant challenges to network security. Federated learning (FL) is a promising approach for detecting IoT botnets while preserving data privacy. However, the black-box nature of FL models impedes their interpretability and transparency, which are crucial for trust and accountability in security applications. In this paper, we propose an approach to generate explanations for the server model induced for intrusion detection tasks in the FL setting without direct access to data of IoT device-based clients. This involves aggregating SHAP (SHapley Additive ex-Planations) value explanations from individual IoT device-based client models to approximate the server model's explanations. We evaluated this approach by comparing the aggregated client-based explanations with the server-based explanations obtained when the server has access to the data of participating IoT device clients. We employed a deep neural network (DNN) model trained in a horizontal federated learning (HFL) setting with the federated averaging (FedAvg) algorithm. DNN model achieved high detection rates of Accuracy, Precision, Recall & Fl-Score in Botnet Detection of multiclass classification on both IoT device-based client-side models and the server-side model. Additionally, we analyzed the importance of features contributing to IoT botnet detection using the generated SHAP explanations. The results demonstrate that the aggregation of client-based SHAP explanations closely approximates the server-based explanations, achieving comparable explainability without compromising data privacy.