Intrusion Detection System Framework for SDN-Based IoT Networks Using Deep Learning Approaches With XAI-Based Feature Selection Techniques and Domain-Constrained Features

The proliferation of Internet of Things (IoT) applications impact many aspects of life, including smart homes, smart offices, and smart cities, among others. However, it poses significant cybersecurity threats. Intrusion detection systems (IDSs) utilize artificial intelligence, especially deep learning, to mitigate these threats. The design of deep learning models and the quality of datasets are two key factors in creating effective IDSs. Randomly selecting hyperparameters and using datasets with irrelevant features can negatively affect model performance and computational complexity. This study proposes an IDS framework to detect various cyberattacks in SDN-based IoT networks utilizing three deep learning algorithms that incorporate hyperparameter tuning and the feature selection process based on explainable artificial intelligence (XAI), which uses domain-constrained features to improve performance and reduce computational complexity. Two recent flow-based datasets were used to train and assess models to validate the proposed framework. We conducted an extensive set of experiments using the subsets of features derived by XAI-based feature selection techniques, and compared their performance against each other, the baseline, and state-of-the-art models. The experimental results reveal that Shapley Additive Explanations and Random Forest feature importance are the reliable feature selection techniques, as they yield consistent results across all deep learning models and different feature subsets. Furthermore, the convolutional neural network model produced a top performance with an accuracy of 99.9% in the InSDN and 98% in the X-IIoTID datasets for multi-class classification. Our study provides guidelines for selecting suitable XAI-based feature selection techniques that incorporate domain-constrained features in the development of IDSs for SDN-based IoT networks.