Scholarlink

<p>The proliferation of Internet of Things (IoT) devices has escalated the risk of Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks, making the development of effective anomaly detection systems imperative. This study introduces a novel two-stage anomaly detection framework that leverages Isolation Forest (IForest) integrated with explainable AI techniques (SHAP and LIME) to enhance the interpretability of anomaly detection in IoT environments. Utilizing the CICIoT2023 dataset, we conducted two experiments: the first applied the Synthetic Minority Oversampling Technique (SMOTE) to address class imbalance after initial anomaly scoring with IForest, and the second incorporated a feature selection mechanism based on a correlation threshold to streamline the input features before a similar IForest training phase. The framework demonstrated exceptional accuracy, achieving precision scores up to 1.00, recall up to 0.94, F1-scores up to 0.94, and AUC exceeding 0.99 in both experiments. The correlation-based feature selection notably outperformed the SMOTE approach in terms of F1 scores and recall, providing deeper insights into the feature importance and model’s decision-making process. These findings underscore the efficacy of combining IForest with explainable AI to create robust, interpretable models for securing IoT networks against increasingly frequent and complex attacks.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Iforestexplain: a dual-stage isolation forest framework with explainable AI for DoS/DDoS anomaly detection in IoT networks

  • 期刊论文

  • 发表日期：

    2025年9月3日

查看全文
  • Collins Chimezie Obidiagha,
  • Mohamed Rahouti,
  • Hamza Drid,
  • Khaled Hamouid,
  • Yasmine Medjadba,
  • Senthil Kumar Jagatheesaperumal

摘要

The proliferation of Internet of Things (IoT) devices has escalated the risk of Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks, making the development of effective anomaly detection systems imperative. This study introduces a novel two-stage anomaly detection framework that leverages Isolation Forest (IForest) integrated with explainable AI techniques (SHAP and LIME) to enhance the interpretability of anomaly detection in IoT environments. Utilizing the CICIoT2023 dataset, we conducted two experiments: the first applied the Synthetic Minority Oversampling Technique (SMOTE) to address class imbalance after initial anomaly scoring with IForest, and the second incorporated a feature selection mechanism based on a correlation threshold to streamline the input features before a similar IForest training phase. The framework demonstrated exceptional accuracy, achieving precision scores up to 1.00, recall up to 0.94, F1-scores up to 0.94, and AUC exceeding 0.99 in both experiments. The correlation-based feature selection notably outperformed the SMOTE approach in terms of F1 scores and recall, providing deeper insights into the feature importance and model’s decision-making process. These findings underscore the efficacy of combining IForest with explainable AI to create robust, interpretable models for securing IoT networks against increasingly frequent and complex attacks.