An Interpretable Intrusion Detection Approach for IoT Using Graph Attention Networks and Transformer Models with Balanced Learning.
Saved in:
| Title: | An Interpretable Intrusion Detection Approach for IoT Using Graph Attention Networks and Transformer Models with Balanced Learning. |
|---|---|
| Authors: | WILSON, J.1 wilsonjohnjoseph@gmail.com, DESHPANDE, Abhijit P.2 abhijitpd22@gmail.com, PREMKUMAR, M.3 prem53kumar@gmail.com, YUVARAJA, T.4 bharathikncet@gmail.com |
| Source: | Technical Gazette / Tehnički Vjesnik. 2026, Vol. 33 Issue 3, p1056-1063. 8p. |
| Subjects: | Intrusion detection systems (Computer security), Internet of things, Transformer models, Synthetic data, Artificial intelligence, Feature selection |
| Abstract: | Intrusion Detection Systems (IDSs) in Internet of Things (IoT) environments face persistent challenges, including class imbalance in network traffic data and the limited interpretability of black-box machine learning models. This paper proposes a novel, interpretable framework that effectively addresses both concerns. We introduce a Diffusion Model-based Synthetic Data Generator (DM-SDG) coupled with Prototype-Based Undersampling (PBUS) to mitigate class imbalance issues without compromising data integrity. For enhanced feature selection and dimensionality reduction, a dual-stage feature refinement strategy is employed using Self-Supervised Feature Filtering (SSFF) and SHAP-Guided Recursive Pruning (SGRP). Our classification stage incorporates Graph Attention Networks (GATs) and Transformer-based Intrusion Detection Systems (T-IDS), which provide improved context-awareness and sequence modeling in dynamic IoT environments. To enhance transparency and model trustworthiness, we integrate three explainability mechanisms: Counterfactual Explanations (CE), SHAP Interaction Values, and Explainable Concept Activation Vectors (ECAVs), enabling both global and local interpretation of detection decisions. The proposed solution is evaluated on benchmark datasets including CICIDS2018, CIC-ToN-IoT, and NF-UNSW-NB15-v2. Experimental results demonstrate accuracy improvements ranging from 0.5% to 2.4%, along with consistent F1-score and MCC gains of 1.5-3.5% over leading baselines such as CTGAN-ENN. Our framework achieves a balanced trade-off between detection accuracy, computational efficiency, and explainability, making it highly suitable for deployment in real-time IoT security infrastructures. [ABSTRACT FROM AUTHOR] |
| Copyright of Technical Gazette / Tehnički Vjesnik is the property of Tehnicki Vjesnik and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Database: | Engineering Source |
| FullText | Links: – Type: pdflink Text: Availability: 0 |
|---|---|
| Header | DbId: egs DbLabel: Engineering Source An: 195131793 AccessLevel: 6 PubType: Academic Journal PubTypeId: academicJournal PreciseRelevancyScore: 0 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: An Interpretable Intrusion Detection Approach for IoT Using Graph Attention Networks and Transformer Models with Balanced Learning. – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22WILSON%2C+J%2E%22">WILSON, J.</searchLink><relatesTo>1</relatesTo><i> wilsonjohnjoseph@gmail.com</i><br /><searchLink fieldCode="AR" term="%22DESHPANDE%2C+Abhijit+P%2E%22">DESHPANDE, Abhijit P.</searchLink><relatesTo>2</relatesTo><i> abhijitpd22@gmail.com</i><br /><searchLink fieldCode="AR" term="%22PREMKUMAR%2C+M%2E%22">PREMKUMAR, M.</searchLink><relatesTo>3</relatesTo><i> prem53kumar@gmail.com</i><br /><searchLink fieldCode="AR" term="%22YUVARAJA%2C+T%2E%22">YUVARAJA, T.</searchLink><relatesTo>4</relatesTo><i> bharathikncet@gmail.com</i> – Name: TitleSource Label: Source Group: Src Data: <searchLink fieldCode="JN" term="%22Technical+Gazette+%2F+Tehnički+Vjesnik%22">Technical Gazette / Tehnički Vjesnik</searchLink>. 2026, Vol. 33 Issue 3, p1056-1063. 8p. – Name: Subject Label: Subjects Group: Su Data: <searchLink fieldCode="DE" term="%22Intrusion+detection+systems+%28Computer+security%29%22">Intrusion detection systems (Computer security)</searchLink><br /><searchLink fieldCode="DE" term="%22Internet+of+things%22">Internet of things</searchLink><br /><searchLink fieldCode="DE" term="%22Transformer+models%22">Transformer models</searchLink><br /><searchLink fieldCode="DE" term="%22Synthetic+data%22">Synthetic data</searchLink><br /><searchLink fieldCode="DE" term="%22Artificial+intelligence%22">Artificial intelligence</searchLink><br /><searchLink fieldCode="DE" term="%22Feature+selection%22">Feature selection</searchLink> – Name: Abstract Label: Abstract Group: Ab Data: Intrusion Detection Systems (IDSs) in Internet of Things (IoT) environments face persistent challenges, including class imbalance in network traffic data and the limited interpretability of black-box machine learning models. This paper proposes a novel, interpretable framework that effectively addresses both concerns. We introduce a Diffusion Model-based Synthetic Data Generator (DM-SDG) coupled with Prototype-Based Undersampling (PBUS) to mitigate class imbalance issues without compromising data integrity. For enhanced feature selection and dimensionality reduction, a dual-stage feature refinement strategy is employed using Self-Supervised Feature Filtering (SSFF) and SHAP-Guided Recursive Pruning (SGRP). Our classification stage incorporates Graph Attention Networks (GATs) and Transformer-based Intrusion Detection Systems (T-IDS), which provide improved context-awareness and sequence modeling in dynamic IoT environments. To enhance transparency and model trustworthiness, we integrate three explainability mechanisms: Counterfactual Explanations (CE), SHAP Interaction Values, and Explainable Concept Activation Vectors (ECAVs), enabling both global and local interpretation of detection decisions. The proposed solution is evaluated on benchmark datasets including CICIDS2018, CIC-ToN-IoT, and NF-UNSW-NB15-v2. Experimental results demonstrate accuracy improvements ranging from 0.5% to 2.4%, along with consistent F1-score and MCC gains of 1.5-3.5% over leading baselines such as CTGAN-ENN. Our framework achieves a balanced trade-off between detection accuracy, computational efficiency, and explainability, making it highly suitable for deployment in real-time IoT security infrastructures. [ABSTRACT FROM AUTHOR] – Name: AbstractSuppliedCopyright Label: Group: Ab Data: <i>Copyright of Technical Gazette / Tehnički Vjesnik is the property of Tehnicki Vjesnik and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.) |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=egs&AN=195131793 |
| RecordInfo | BibRecord: BibEntity: Identifiers: – Type: doi Value: 10.17559/TV-20250720002849 Languages: – Code: eng Text: English PhysicalDescription: Pagination: PageCount: 8 StartPage: 1056 Subjects: – SubjectFull: Intrusion detection systems (Computer security) Type: general – SubjectFull: Internet of things Type: general – SubjectFull: Transformer models Type: general – SubjectFull: Synthetic data Type: general – SubjectFull: Artificial intelligence Type: general – SubjectFull: Feature selection Type: general Titles: – TitleFull: An Interpretable Intrusion Detection Approach for IoT Using Graph Attention Networks and Transformer Models with Balanced Learning. Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: WILSON, J. – PersonEntity: Name: NameFull: DESHPANDE, Abhijit P. – PersonEntity: Name: NameFull: PREMKUMAR, M. – PersonEntity: Name: NameFull: YUVARAJA, T. IsPartOfRelationships: – BibEntity: Dates: – D: 01 M: 05 Text: 2026 Type: published Y: 2026 Identifiers: – Type: issn-print Value: 13303651 Numbering: – Type: volume Value: 33 – Type: issue Value: 3 Titles: – TitleFull: Technical Gazette / Tehnički Vjesnik Type: main |
| ResultId | 1 |
