Towards White-Box IDS: Integrating Explainability in IoT Ecosystems

Explainable AI (XAI) has recently garnered sig-nificant traction from researchers. Integrating XAI with state-of-the-art machine/deep learning models increases the trans-parency and interpretability of the decision models' inner workings. However, XAI's applicability still needs to be explored in the field of network security for the loT ecosystem. Past research has extensively focused on building robust intrusion detection systems for loT networks. However, little attention has been paid to the interpretation and how MLIDL models make predictions. Thus, a white-box AI model is required to increase trustability. By integrating XAI, we aim to collect significant information on how different features contribute to predictions and provide a more trusted and transparent system. This, in turn, not only helps us in feature selection but also offers hidden insights into how the classifier performs, thus enabling network analysts to make decisions accordingly. Using the CICloT2023 dataset, this research proposes a hybrid DL model using CNN and BiLSTM that uses XAI techniques, SHAP and LIME to make our IDS more transparent and trustworthy. Using SHAP as part of the feature selection, we increased our model's accuracy by 4 %. We further analyzed our model's efficiency on several performance metrics like recall, precision, ROC curve, and confusion matrix. We subsequently incorporated LIME for local explanations to understand how each attack instance is being predicted.