An Interpretable Intrusion Detection Approach for IoT Using Graph Attention Networks and Transformer Models with Balanced Learning.

Saved in:

Bibliographic Details
Title:	An Interpretable Intrusion Detection Approach for IoT Using Graph Attention Networks and Transformer Models with Balanced Learning.
Authors:	WILSON, J.¹ wilsonjohnjoseph@gmail.com, DESHPANDE, Abhijit P.² abhijitpd22@gmail.com, PREMKUMAR, M.³ prem53kumar@gmail.com, YUVARAJA, T.⁴ bharathikncet@gmail.com
Source:	Technical Gazette / Tehnički Vjesnik. 2026, Vol. 33 Issue 3, p1056-1063. 8p.
Subjects:	Intrusion detection systems (Computer security), Internet of things, Transformer models, Synthetic data, Artificial intelligence, Feature selection
Abstract:	Intrusion Detection Systems (IDSs) in Internet of Things (IoT) environments face persistent challenges, including class imbalance in network traffic data and the limited interpretability of black-box machine learning models. This paper proposes a novel, interpretable framework that effectively addresses both concerns. We introduce a Diffusion Model-based Synthetic Data Generator (DM-SDG) coupled with Prototype-Based Undersampling (PBUS) to mitigate class imbalance issues without compromising data integrity. For enhanced feature selection and dimensionality reduction, a dual-stage feature refinement strategy is employed using Self-Supervised Feature Filtering (SSFF) and SHAP-Guided Recursive Pruning (SGRP). Our classification stage incorporates Graph Attention Networks (GATs) and Transformer-based Intrusion Detection Systems (T-IDS), which provide improved context-awareness and sequence modeling in dynamic IoT environments. To enhance transparency and model trustworthiness, we integrate three explainability mechanisms: Counterfactual Explanations (CE), SHAP Interaction Values, and Explainable Concept Activation Vectors (ECAVs), enabling both global and local interpretation of detection decisions. The proposed solution is evaluated on benchmark datasets including CICIDS2018, CIC-ToN-IoT, and NF-UNSW-NB15-v2. Experimental results demonstrate accuracy improvements ranging from 0.5% to 2.4%, along with consistent F1-score and MCC gains of 1.5-3.5% over leading baselines such as CTGAN-ENN. Our framework achieves a balanced trade-off between detection accuracy, computational efficiency, and explainability, making it highly suitable for deployment in real-time IoT security infrastructures. [ABSTRACT FROM AUTHOR]
	Copyright of Technical Gazette / Tehnički Vjesnik is the property of Tehnicki Vjesnik and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Database:	Engineering Source

Description
Abstract:	Intrusion Detection Systems (IDSs) in Internet of Things (IoT) environments face persistent challenges, including class imbalance in network traffic data and the limited interpretability of black-box machine learning models. This paper proposes a novel, interpretable framework that effectively addresses both concerns. We introduce a Diffusion Model-based Synthetic Data Generator (DM-SDG) coupled with Prototype-Based Undersampling (PBUS) to mitigate class imbalance issues without compromising data integrity. For enhanced feature selection and dimensionality reduction, a dual-stage feature refinement strategy is employed using Self-Supervised Feature Filtering (SSFF) and SHAP-Guided Recursive Pruning (SGRP). Our classification stage incorporates Graph Attention Networks (GATs) and Transformer-based Intrusion Detection Systems (T-IDS), which provide improved context-awareness and sequence modeling in dynamic IoT environments. To enhance transparency and model trustworthiness, we integrate three explainability mechanisms: Counterfactual Explanations (CE), SHAP Interaction Values, and Explainable Concept Activation Vectors (ECAVs), enabling both global and local interpretation of detection decisions. The proposed solution is evaluated on benchmark datasets including CICIDS2018, CIC-ToN-IoT, and NF-UNSW-NB15-v2. Experimental results demonstrate accuracy improvements ranging from 0.5% to 2.4%, along with consistent F1-score and MCC gains of 1.5-3.5% over leading baselines such as CTGAN-ENN. Our framework achieves a balanced trade-off between detection accuracy, computational efficiency, and explainability, making it highly suitable for deployment in real-time IoT security infrastructures. [ABSTRACT FROM AUTHOR]
ISSN:	13303651
DOI:	10.17559/TV-20250720002849