GBFKAN: An Adaptive Multilayer Interpretable Architecture for Intrusion Detection in Various Internet of Things Scenarios

As Internet of Things (IoT) technologies continue to evolve and gain widespread integration across various sectors, IoT devices have become increasingly interconnected and ubiquitous. However, this surge has also led to more sophisticated, diverse, and covert attacks, posing severe security challenges to IoT ecosystems and their defense mechanisms. Intrusion Detection Systems (IDS) are instrumental in securing the IoT by uncovering and mitigating malicious behaviors in real-time. Nevertheless, the growing complexity of network traffic presents significant challenges for IDS, often resulting in a higher false alarm rate and a lower detection rate, due to the intricate characteristics of space and notable temporal dependencies present in network traffic. We conduct an in-depth dimensionality reduction analysis using the t-distributed Stochastic Neighbor Embedding methodology to examine the relationships among attack examples. Then, to enhance the generalization and robustness of IDS, we propose GBFKAN, a novel interpretable three-layer network architecture. The structured design of GBFKAN can comprehensively extract and perceive key information from multiple abstract levels in the raw traffic, enhancing the architecture’s generalization ability and robustness. Furthermore, we utilize the SHapley Additive ExPlanations method to provide detailed explanations of the detection outcomes, augmenting its credibility. Building on this, we successfully identify the erroneous decision-making paradigms within GBFKAN by incorporating empirical knowledge. Extensive simulation experiments conducted on the four widely recognized intrusion detection datasets have conclusively demonstrated that our proposed GBFKAN model surpasses existing methods in terms of intrusion detection performance.