Explainable Threat Attribution for IoT Networks Using Conditional SHAP and Flow Behavior Modelling

1. Problem Statement

The rapid expansion of the Internet of Things (IoT) has created vast attack surfaces vulnerable to diverse cyber threats (e.g., DDoS, Mirai botnets, spoofing, brute-force). While Machine Learning (ML) models can detect intrusions, they face two critical limitations in IoT security:

1. Binary Limitations: Most existing systems treat intrusion detection as a binary problem (benign vs. malicious), which lacks the granularity required for forensic analysis and automated defense against specific attack vectors.
2. Lack of Explainability: High-performance models (often deep learning) operate as "black boxes." In high-stakes environments, security analysts require not just accurate predictions but transparent, actionable explanations of why a specific flow was classified as a specific threat type (e.g., distinguishing a DDoS flood from a Brute Force attempt).

2. Methodology

The authors propose a framework combining flow behavior modeling with class-aware Explainable AI (XAI) using the CICIoT2023 dataset.

A. Data Preparation & Semantic Grouping

• Dataset: Used the CICIoT2023 dataset (subset of ~1 million samples), which contains over 10 million flows and 34 distinct attack labels.
• Label Aggregation: To balance semantic coherence with classification complexity, the 34 original attack types were grouped into 8 high-level classes:
  1. Benign Traffic
  2. DDoS Attacks
  3. DoS Attacks
  4. Mirai Botnet Attacks
  5. Reconnaissance
  6. Spoofing Attacks
  7. Brute Force Attacks
  8. Web Exploits & Injection
• Preprocessing:
  • Feature Selection: Removed highly correlated (multicollinear) and low-variance features (e.g., Rate, Srate, Std, Radius) identified via Variance Inflation Factor (VIF) analysis to prevent overfitting.
  • Scaling: Scaled Inter-Arrival Time (IAT) from microseconds to seconds to improve tree-split stability.
  • Class Imbalance: Addressed the severe imbalance (DDoS dominates with >70% of samples) using class-weight adjustment rather than oversampling/undersampling to preserve flow distribution integrity.

B. Predictive Modeling

• Model Selection: Evaluated five tree-based ensemble classifiers: Random Forest, XGBoost, LightGBM, Gradient Boosting, and Extra Trees.
• Selection Criteria: Used 4-fold cross-validation with macro-averaged Accuracy, Precision, Recall, and F1-score.
• Final Model: Gradient Boosting was selected for its superior balance of Recall and F1-score, crucial for detecting minority classes in imbalanced datasets.

C. Explainability Framework (SHAP)

The core innovation is the application of SHAP (SHapley Additive exPlanations) at two levels:

1. Global Attribution: Identifying overall feature importance across the entire dataset.
2. Local/Class-Specific Attribution:
   • Beeswarm Plots: Visualizing how feature values (high/low) push predictions toward specific classes.
   • Waterfall Plots: Tracing the decision trajectory for individual instances, showing how the base prediction shifts as features contribute positively or negatively.
   • Behavioral Reasoning: Mapping SHAP values to network semantics (e.g., linking low IAT to flooding, high variance to scanning).

3. Key Contributions

1. Semantic Threat Modeling: Moving beyond binary detection to a structured 8-class taxonomy that aligns with forensic needs.
2. Class-Aware Explainability: Unlike standard XAI which provides a global ranking, this work visualizes per-class decision logic, revealing how the model distinguishes between similar threats (e.g., DDoS vs. DoS) based on specific feature interactions.
3. Flow-Level Behavioral Reasoning: The study interprets SHAP outputs in the context of network physics, connecting statistical features (e.g., Variance, IAT, TCP Flags) to attacker strategies (e.g., packet burstiness, session termination, payload consistency).
4. Robust Pipeline: A complete pipeline from data cleaning and imbalance handling to model training and deep forensic analysis, validated on a large-scale, real-world IoT dataset.

4. Key Results & Findings

Performance

• The Gradient Boosting model achieved high performance across all metrics, with significant improvements in Recall for minority classes (Spoofing, Reconnaissance, Web Exploits) due to class-weighting.
• The model successfully distinguished distinct behavioral signatures across the 8 classes.

Explainability Insights (What the Model Learned)

• Inter-Arrival Time (IAT): The most globally influential feature.
  • Low IAT: Strongly indicates DDoS/DoS (rapid-fire flooding).
  • High IAT: Associated with Benign traffic or Mirai Botnets (command-and-control delays).
• Packet Size & Variance:
  • Small, uniform sizes: Hallmarks of Brute Force, Web Exploits, and DDoS (control-heavy, low payload).
  • High Variance/Magnitude: Indicates Reconnaissance (scanning) or Mirai (structured but large payloads).
• TCP Flags:
  • RST Counts: Critical for distinguishing Spoofing (failed handshakes) and Benign (normal closures).
  • SYN/URG Counts: Key indicators for Brute Force (repeated connections) and Injection attacks.
• Decision Trajectories:
  • Benign: Driven by high Header Length, Tot Size, and structured RST counts.
  • Brute Force: Driven by high Variance, IAT, and SYN counts with low data payload.
  • Mirai: Characterized by large Tot Size and extended IAT, contrasting with the "minimalist" nature of DDoS.

5. Significance and Limitations

Significance

• Trust in AI: Bridges the gap between high-performance ML and operational trust, allowing security analysts to audit why an alert was triggered.
• Forensic Utility: Provides actionable insights for incident response by categorizing threats semantically rather than just flagging them as "malicious."
• IoT Security: Specifically tailored for the resource-constrained and heterogeneous nature of IoT networks, using flow-level telemetry rather than heavy payload inspection.

Limitations

• Static Dataset: The model relies on the CICIoT2023 dataset, which is static and pre-labeled. It may struggle with adaptive, multi-stage, or zero-day attacks that deviate from historical traffic profiles.
• Latency: The reliance on flow-level statistics (requiring full session observation or substantial chunks of data) limits its applicability for real-time, proactive detection in streaming environments.
• Overfitting Risk: The model's reliance on specific thresholds (e.g., exact IAT values) may reduce generalizability to novel attack variants.

Future Directions

The authors suggest integrating semi-supervised learning to handle unlabeled data, adopting online/streaming learning for real-time deployment, and incorporating cross-modal signals (device identity, topology) for a more holistic defense.

Conclusion

This paper demonstrates that combining Gradient Boosting with conditional SHAP analysis creates a powerful, interpretable framework for IoT threat attribution. It successfully moves beyond "black box" detection to provide a transparent, semantically rich understanding of how different IoT attacks manifest in network flow behavior, laying the groundwork for trustworthy, auditable AI in cybersecurity.