IJCNC 07

Toward Operationally Reliable IoT Network Intrusion Detection: Explainable Boosting with Diagnostic Error Analysis

Enoch Success Boakai1 and Sunil Lalchand Bajeja

Faculty of Computer Applications, Marwadi University, Rajkot – 360003, Gujarat, India

ABSTRACT

The accelerated growth of Internet of Things (IoT) networks has substantially increased their vulnerability to sophisticated cyber threats, necessitating reliable and transparent intrusion detection systems (IDS). While boosting-based machine learning algorithms demonstrate strong predictive performance, many studies prioritize accuracy alone without adequately examining operational reliability or model interpretability. This study presents a structured evaluation of boosting-based intrusion detection using the TON_IoT network telemetry dataset, comparing a Decision Tree baseline against three state-of-the-art boosting algorithms: XGBoost, LightGBM, and CatBoost. Models are assessed using accuracy, ROC-AUC, and operational error metrics, with particular emphasis on false negatives due to their critical security implications. Experimental results demonstrate that LightGBM achieved the best overall performance, with 99.89% accuracy, the lowest false positive count (28), and the lowest false negative count (13), representing a 61.8% reduction in missed attacks compared with the baseline. A 5-fold cross-validation analysis confirms model stability. To enhance transparency, SHapley Additive exPlanations (SHAP) are applied for both global and local interpretability. Global analysis revealed protocol-level dominance, with TCP-based traffic emerging as the primary driver of malicious classification, while local explanations identified protocoldependent bias contributing to rare false negatives. These findings demonstrate that integrating explainable AI with boosting algorithms achieves near-optimal detection performance while revealing structural dataset biases and operational blind spots. The proposed framework supports the development of interpretable, high-performance IoT intrusion detection systems.

KEYWORDS

Internet of Things (IoT), Intrusion Detection Systems (IDS), Gradient Boosting, LightGBM, XGBoost, CatBoost, Explainable Artificial Intelligence (XAI), SHapley Additive Explanations (SHAP), Diagnostic Error Analysis

1. INTRODUCTION

Through the extensive use of sensors, actuators, and networked connectivity, the Internet of Things (IoT) represents a natural evolution of the Internet by extending connectivity to physical objects. It has found widespread application in sectors such as healthcare, transportation, agriculture, and smart cities, enabling the automation, monitoring, and optimization of numerous processes [1]. This invention is more than just a technical advancement; it ushers in a new era of human efficiency, lifestyle, and engagement with the physical world. The IoT architecture is commonly structured into three interconnected layers. The perception layer consists of sensors and smart devices that gather data from the physical environment, such as wearable health monitors tracking heart rate. The network (transport) layer enables communication between these devices and backend systems using technologies like LoRaWAN, cellular networks, or Bluetooth to transmit the collected data. The application layer processes this information to provide user-oriented services, for example, a health app analyzing heart rate data and sending alerts or fitness insights to the user [2], [3]. Figure 1 illustrates the three-layer IoT architecture together with representative security threats that can affect each layer and motivate the deployment of intrusion detection systems.

A study has reported that IoT systems are exposed to security vulnerabilities at every layer of their architecture. At the perception layer, sensors and devices can be compromised through malware infection, eavesdropping, or signal disruption. At the network layer, threats include spoofing, denial-of-service (DoS) attacks, man-in-the-middle intrusions, and manipulation of routing data. At the application layer, risks extend to viruses, worms, and phishing attacks [4]. It is anticipated that the number of IoT devices will continue to increase rapidly, bringing to light a number of complex security issues that represent a serious risk to the availability, confidentiality, and integrity of data over these networks [5]. IoT networks mainly consist of devices with limited computational capabilities and low security. Therefore, robust network security measures are imperative. In particular, Intrusion Detection Systems play a very important role in the preservation of an IoT environment from malicious activities. The term “intrusion detection” primarily refers to the process of monitoring and identifying the unauthorized use, exploitation, or even misuse of a network by both internal and external adversaries. This monitoring and identification procedure need to be carried out in real time. Intrusion Detection System (IDS) has emerged as a key component of computer security, protecting systems from a wide range of threats and weaknesses. To make sure that such deployed systems are capable of enhancing the security of real networking environments, they should ensure that the rate of false positives is low [6]. As a result of greater network connectivity, rapid technological innovation, and the availability of skilled hackers, intrusion detection is becoming increasingly difficult to accomplish. The limitations of traditional intrusion detection systems, which depend primarily on known attack signatures, have driven the shift toward machine learning–based IDS solutions. These advanced systems are trained on datasets to classify and predict attacks by learning patterns from both legitimate and malicious network traffic. While various machine learning techniques have been successfully applied for intrusion classification, they still face challenges, particularly in reducing high false positive rates [7], [8]. Machine learning–based IDS approaches have gained prominence due to their ability to model complex network behavior patterns and detect previously unseen attack signatures. Among these approaches, tree-based ensemble methods, particularly boosting algorithms, have demonstrated strong predictive performance in cybersecurity contexts. Techniques such as XGBoost, LightGBM, and CatBoost leverage gradient boosting frameworks to iteratively refine decision boundaries, often achieving superior generalization compared to single-tree classifiers. Despite these advances, two significant limitations persist in contemporary intrusion detection research. First, many studies emphasize classification accuracy as the primary evaluation metric, often reporting near-perfect results on benchmark datasets without sufficiently analyzing operational error behavior. In intrusion detection, however, the implications of false negatives (missed attacks) differ fundamentally from false positives (false alarms). A highly accurate model may still be unsuitable for deployment if it fails to minimize undetected malicious activity. Second, boosting-based models are frequently treated as black-box systems. While their predictive performance is strong, limited transparency regarding feature influence and decision rationale can reduce trustworthiness, complicate deployment approval processes, and hinder security analyst adoption. Interpretability is particularly important in IoT environments, where security administrators must understand and justify automated decisions affecting heterogeneous device networks. To address these challenges, this study evaluates boosting-based intrusion detection under a dual objective framework: performance robustness and interpretability transparency. Using the TON_IoT network telemetry dataset, we conduct a controlled experimental comparison between a classical Decision Tree baseline and three state-of-the-art boosting algorithms, XGBoost, LightGBM, and CatBoost. Rather than focusing solely on accuracy, the analysis emphasizes false positive and false negative behavior, ROC characteristics, and operational reliability. Beyond performance benchmarking, the study integrates SHapley Additive exPlanations (SHAP) to provide both global and local interpretability of the best-performing model. Global SHAP analysis identifies the dominant behavioral indicators driving malicious classification, while local SHAP explanations dissect individual correct and incorrect predictions to reveal model strengths and limitations. This approach enables a transparent examination of how protocol usage, port behavior, connection states, and traffic volume attributes contribute to intrusion detection decisions. A particularly important insight emerging from this analysis is the structural influence of protocol distribution within the dataset. Malicious traffic in the TON_IoT network subset is heavily concentrated in TCP-based flows, resulting in strong separability and dominant protocol-level feature importance. While this contributes to high overall accuracy, it also introduces protocol-dependent bias that may affect rare attack patterns occurring over alternative transport layers. By explicitly identifying this limitation through SHAP-based analysis, the study demonstrates how interpretability can uncover blind spots that traditional performance metrics might conceal.

The main contributions of this work are summarized as follows:

• A systematic performance comparison between a baseline decision tree and three boosting-based classifiers(XGBoost, LightGBM, CatBoost) under identical preprocessing and evaluation protocols, establishing a consistent basis for assessing operationally relevant detection performance.
• An operationally grounded evaluation emphasizing false negative minimization and threshold-independent separability, demonstrating that error behavior differentiates models more meaningfully than accuracy alone within the experimental context.
• Implementation of SHAP-based explainability to provide transparent global and local model interpretations, revealing protocol-driven decision patterns and identifying structural dataset biases.
• A diagnostic SHAP-driven error analysis that uncovers how TCP-based attack concentration in the dataset contributes to classifier bias and rare false negatives for nonTCP traffic.

Through this combined performance and interpretability framework, the study advances a methodology for IoT intrusion detection research that prioritizes transparency and operational error analysis alongside predictive accuracy, within the specific context of the TON_IoT network telemetry dataset. The remainder of this paper is structured as follows: Section 2 reviews related work. Section 3 provides an overview of boosting-based intrusion detection ML models and SHAP explainability. Section 4 describes the methodological approaches. Section 5 presents the results and evaluation of the tested models. In Section 6, a critical discussion and interpretation of the results and performance are dealt with. Finally, Section 7 concludes the study.

2. RELATED WORK

Several studies have been conducted to address network intrusion detection within IoT environments. This section reviews research that implements boosting-based machine learning algorithms for identifying intrusions in IoT networks. A structured quantitative systematic review methodology was employed to identify and select relevant studies. An extensive literature search was performed across major scientific databases, including IEEE Xplore, Scopus, ScienceDirect, and SpringerLink. The search was restricted to publications written in English and published in peer-reviewed journals and conference proceedings. Various combinations of the keywords “machine learning,” “boosting,” “intrusion detection,” and “IoT” were applied to the title, abstract, and keyword fields for studies published between 2020 and 2025. However, one seminal study predating the search period was retained as an exception because of its direct relevance to the boosting methods examined in this research. Saiyed and Al-Anbagi [9] proposed GADAD, a lightweight framework for detecting high- and low-volume DDoS attacks in IoT networks using AdaBoost. Evaluated on the ToN_IoT and HL-IoT datasets, the model employed Genetic Algorithm-based feature selection and achieved precision, recall, and F1-scores of up to 100%. The study’s primary contribution was the introduction of a dedicated dataset for low-volume IoT attack detection in edge environments. Ghourabi [10] proposed a hybrid LightGBM–Transformer framework for healthcare IoT/IoMT intrusion and malware detection. Evaluated on multiple datasets including ToN_IoT and Edge-IIoTset, the approach achieved up to 100% accuracy following Bayesian optimization, although deployment complexity remains a challenge. Alissa et al. [11] investigated botnet detection in IoT networks using XGBoost alongside decision tree and logistic regression models. Experiments were conducted on the UNSW-NB15 dataset with SMOTE-based imbalance handling and information gain feature selection. XGBoost achieved 88% test accuracy in binary classification, the study highlights the effectiveness of boosting for botnet detection but notes limitations in cross-dataset generalization. Rani et al. [12] introduced LGB-IDS, a LightGBM-based intrusion detection system for smart home IoT environments. Evaluated on the DS2OS dataset with feature reduction techniques, the model achieved 99.42% accuracy while maintaining low runtime latency suitable for real-time deployment. Tanveer et al. [13] proposed LightEnsemble-Guard, a majority-voting ensemble integrating LightGBM, XGBoost, and Extra Trees for real-time IoT intrusion detection. Tested on the RT-IoT2022 dataset, the model applied embedded feature selection methods to handle imbalanced traffic. The framework achieved 99.55% accuracy with an F1-score of 0.99 while maintaining low computational overhead. The approach demonstrates the effectiveness of lightweight boosting ensembles in resource-constrained environments. Osman et al. [14] presented ML-LGBM, a lightweight LightGBM-based model for detecting Version Number Attacks in RPL-based IoT networks. Using a self-developed dataset exceeding one million records, the model achieved 99.6% accuracy with a false-positive rate of 0.0093. Step-forward feature selection and hyperparameter optimization enhanced efficiency, while low memory consumption supports deployment in constrained IoT devices. Hafsa et al. [15] addressed routing-based IoT attacks using gradient boosting techniques, including CatBoost and XGBoost. Through cross-layer feature engineering, 12 significant attributes were identified from RPL protocol data. The optimized CatBoost model achieved a 99% detection rate with high sensitivity and predictive value. The study demonstrates the importance of multi-layer feature integration in routing-level IoT security. Awotunde et al. [16] evaluated boosting algorithms, particularly XGBoost and AdaBoost, for IIoT intrusion detection using telemetry data from the ToN_IoT dataset, Chi-square-based feature ranking was employed to reduce dimensionality. XGBoost achieved near-perfect performance with reported accuracy of 100% and precision of 0.9995. The study highlights the effectiveness of boosting in heterogeneous industrial environments but acknowledges class imbalance challenges. Abu Al-Haija and Al-Dala’ien [17] proposed ELBA-IoT, an ensemble framework incorporating AdaBoost, RUSBoost, and bagged trees for botnet detection. Using the N-BaIoT-2021 dataset across binary and multiclass scenarios, the model achieved 99.6% accuracy in 10-class classification. Correlation-based feature selection reduced computational cost. The framework demonstrates strong detection performance, though real-world gateway deployment remains future work. Abid et al. [18] developed a hybrid LightGBM–CNN intrusion detection model optimized via Grey Wolf Optimization for feature selection. Evaluated on CICIoT2023 and CICIoMT2024 datasets, the system achieved up to 99.50% accuracy with low false alarm rates. The combination of boosting and deep learning enhances detection capability, although certain attack classes remain underrepresented. Chen et al. [19] proposed a LightGBM-based IoT attack detection scheme enhanced by the GQBWSSA metaheuristic feature selection algorithm. Evaluated on NSL-KDD and CICIoT2023 datasets, the model achieved 99.70% accuracy in binary classification. SHAP analysis was incorporated for interpretability, the study demonstrates that optimized boosting models can effectively address high-dimensional IoT traffic data. Hosain and Çakmak [20] introduced an explainable XGBoost-based IDS for IoMT systems using the WUSTL-EHMS-2020 dataset. Through hybrid sampling and recursive feature elimination, the model achieved 99.22% accuracy and 100% ROC-AUC, while SHAP and LIME provided model interpretability. Aly and Alotaibi [21] proposed the Transformer–GWO–Boosting framework for anomaly detection in IIoT environments. The model integrates a temporal transformer encoder with Logistic Boosting, optimized via Grey Wolf Optimization. On real industrial sensor data, it achieved 98.2% accuracy with strong AUC performance. The framework effectively addresses temporal dependencies and concept drift in manufacturing systems. Khan et al. [22] developed an interpretable boosting-based intrusion detection model for HVAC IoT systems. Among several boosting algorithms evaluated, XGBoost achieved the best performance with 99.98% accuracy, while SHAP and LIME enhanced transparency. Sama et al. [23] evaluated multiple machine learning classifiers for IoT intrusion detection, with particular emphasis on ensemble methods such as Gradient Boosting (GB) and XGBoost. Experiments were conducted on the RT-IoT2022 dataset for multiclass traffic classification following extensive pre-processing and grid-search hyperparameter tuning. Results showed that ensemble approaches outperformed individual models, with Extremely Randomized Trees achieving the highest accuracy of 99.7%, while XGBoost attained 99.6% accuracy and an F1-score of 0.95. The study confirms the effectiveness of boosting techniques for IoT security, though evaluation on a single dataset may limit broader generalizability. The literature reveals several important trends in boosting-based IoT intrusion detection research between 2020 and 2025. XGBoost and LightGBM clearly dominate the literature, reflecting their suitability for highdimensional network traffic and imbalanced datasets. In recent years, there has been a noticeable shift toward hybrid architectures, where boosting models are combined with deep learning components such as CNNs and Transformers, as well as metaheuristic optimization techniques for feature selection. Although previous studies have demonstrated the effectiveness of boosting-based approaches for intrusion detection, with many reporting accuracy levels exceeding 99 percent, several important gaps remain, most existing works focus on a single boosting algorithm, employ limited explainability mechanisms, or do not provide detailed operational error analysis. Furthermore, few studies perform a systematic comparison of multiple boosting techniques under identical experimental conditions. These limitations motivate the present study.

3. BOOSTING-BASED INTRUSION DETECTION MODELS AND SHAP EXPLAINABILITY

3.1. Machine Learning Models

In IoT intrusion detection systems, machine learning (ML) techniques are fundamental to strengthening network security. Among these, boosting stands out as an ensemble-based supervised learning approach that enhances detection performance. By integrating multiple learners into a unified, robust model, boosting reduces both bias and variance, thereby improving predictive accuracy [24]. Those simple models are called weak learners or base estimators [25]. It sequentially aggregates the outputs of multiple base learners, with each new learner trained to minimize the residual errors generated by the previous model. These algorithms are grounded in ensemble learning principles, enabling machine learning models to attain improved predictive performance in detecting and mitigating intrusions within IoT environments. This study focuses on three representative and widely adopted boosting algorithms: XGBoost, LightGBM, and CatBoost.

3.1.1. Decision Tree (Baseline)

A Decision Tree (DT) classifier is adopted as a classical, interpretable baseline for comparison with boosting-based ensemble models. A Decision Tree learns a hierarchy of simple decision rules inferred from the data features [26]. It recursively partitions the feature space by selecting splits that maximize impurity reduction, typically measured using the Gini impurity defined in Equation (1):

Where 𝑝𝑝𝑘𝑘 denotes the probability of class 𝑘𝑘 in a given node. The impurity measure in Equation (1) is reduced through recursive partitioning, allowing the tree to identify increasingly homogeneous subsets of the data. At each split, the feature and threshold that maximize the decrease in impurity are selected. The final prediction is determined by the majority class within each terminal leaf node. Although single decision trees are prone to high variance and limited generalization compared to ensemble methods, they provide a transparent and computationally efficient reference model. Including a DT baseline enables quantification of the incremental performance and reliability gains achieved through boosting-based ensemble learning.

3.1.2. Extreme Gradient Boosting

Extreme Gradient Boosting (XGBoost) is a regularized gradient boosting framework that enhances traditional gradient boosting through second-order optimization and explicit model complexity control. Compared to standard GBM, XGBoost improves computational efficiency and predictive stability by incorporating parallelized tree construction and regularization mechanisms [27].

Given a dataset (𝑥𝑥𝑖𝑖, 𝑦𝑦𝑖𝑖), the prediction at boosting iteration 𝑡𝑡 is expressed as Equation (2):

Where 𝑓𝑓𝑡𝑡 represents the newly added regression tree at iteration 𝑡𝑡. The model is trained by minimizing a regularized objective function, shown in Equation (3):

Where 𝑙𝑙(⋅) is a differentiable loss function and Ω(⋅) is a regularization term that penalizes model complexity (e.g., number of leaves and leaf weights), thereby reducing overfitting. By leveraging second-order gradient information and explicit regularization, XGBoost achieves faster convergence and improved generalization capability, making it highly effective for intrusion detection in IoT environments.

3.1.3. Light Gradient Boosting

Light Gradient Boosting (LightGBM) is a gradient boosting framework designed to improve training efficiency and scalability for large datasets. As an implementation of Gradient Boosted Decision Trees (GBDT), it combines multiple decision trees sequentially to enhance predictive performance [28]. Unlike conventional Gradient Boosting Machines (GBM), which grow trees level-wise, LightGBM employs a leaf-wise growth strategy that expands the leaf yielding the greatest reduction in loss at each iteration. The gain obtained from a candidate split is computed using Equation (4):

Where 𝐺𝐺𝐿𝐿, 𝐺𝐺𝑅𝑅 and 𝐻𝐻𝐿𝐿, 𝐻𝐻𝑅𝑅 denote the accumulated first- and second-order gradients for the left(𝐿𝐿) and right(𝑅𝑅) child nodes, respectively, while λ and γ are regularization parameters. At each iteration, LightGBM selects the split that maximizes the gain defined in Equation (4), thereby improving model accuracy while maintaining computational efficiency. In addition, LightGBM incorporates histogram-based feature binning and Gradient-based One-Side Sampling (GOSS) to reduce computational complexity and memory consumption. These optimizations enable faster training and improved scalability, making LightGBM particularly suitable for large-scale IoT intrusion detection datasets such as TON_IoT, where efficient processing of high-dimensional network traffic features is essential.

3.1.4. Categorical Boosting

Categorical Boosting (CatBoost) is a gradient boosting algorithm designed to address challenges associated with categorical features and prediction shift [29]. It is specifically developed to reduce target leakage and improve generalization in structured data. CatBoost introduces Ordered Boosting, which reduces target leakage by computing gradients using permutation-based training schemes. This ensures that, for each sample, the prediction is computed using only preceding observations in the permutation, thereby improving generalization. Additionally, categorical features are transformed using regularized target statistics as defined in Equation (5):

where 𝑝𝑝 represents the prior target probability, 𝑁𝑁 is the category frequency, and α controls smoothing. By mitigating overfitting caused by naive target encoding and ensuring unbiased gradient estimation, CatBoost provides robust performance in structured network traffic datasets containing mixed feature types

Although all three algorithms optimize additive tree ensembles under the gradient boosting paradigm, their architectural differences, second-order regularization (XGBoost), leaf-wise growth with sampling optimization (LightGBM), and ordered categorical handling (CatBoost), offer complementary strengths. Evaluating these models under identical pre-processing and validation conditions enables a structured comparison of detection capability and operational reliability in IoT intrusion detection.

3.2. Explainable AI and SHAP

Modern intrusion detection systems (IDS) increasingly rely on high-capacity machine learning models (e.g., boosted ensembles) due to their strong performance on high-dimensional network telemetry. However, these models are often opaque, creating practical barriers to operational adoption: security analysts must understand why an alert was generated, whether the decision is stable under realistic traffic variation, and which features drive false positives or (more critically) false negatives. Explainable AI (XAI) addresses this gap by producing human-interpretable evidence for model decisions, supporting analyst trust, auditability, and faster triage. In security contexts, where decisions are consequential and adversaries evolve, interpretability is essential for validating that the detector learns meaningful attack signals rather than spurious correlations, and for guiding defensible remediation actions. Recent IDS-focused XAI literature shows that explanations improve transparency and usability of ML-based IDS, and help characterize model weaknesses and biases that may remain hidden behind aggregate accuracy metrics [30], [31], [32]. More broadly,XAI is a key enabler for responsible deployment of complex AI systems by improving interpretability and supporting debugging and governance processes [33]. In this work, SHapley Additive exPlanations (SHAP) is adopted because it provides a unified, theoretically grounded approach to attributing model predictions to input features using Shapley-based contributions from cooperative game theory [34]. SHAP expresses explanations as an additive feature attribution model, where each prediction is decomposed into a baseline output and feature contributions as shown in Equation (6):

Where ϕ0 is the expected model output over the training distribution and 𝑀𝑀 is the number of features. As indicated by Equation (6), each SHAP value represents the contribution of a feature to the deviation from the baseline, providing locally faithful and globally comparable explanations [34]. A key advantage of SHAP, particularly for tree-based boosting models, is the availability of efficient algorithms such as TreeSHAP, which compute exact or consistent feature attributions for decision-tree ensembles, enabling both global interpretation (feature importance across the dataset) and local interpretation (instance-level explanations) at a practical computational cost [35]. Consequently, SHAP enables security-relevant analysis beyond accuracy, such as investigating rare false negatives, identifying dominant protocol- or feature-driven decision patterns, and diagnosing biases introduced by dataset structure or feature prevalence, thereby strengthening transparency and deployment readiness of boosting-based IoT intrusion detection pipelines [30], [31], [32], [35]

4. METHODOLOGY

To provide a structured overview of the proposed methodology, Figure 2 illustrates the conceptual framework of the study. The framework presents the end-to-end workflow, beginning with the TON_IoT network dataset and progressing through preprocessing, modeling, explainability integration, and operational evaluation stages. The preprocessing phase ensures data integrity through duplicate removal, exclusion of host-identifying attributes, and categorical encoding to construct a refined feature space. The modeling stage consists of a baseline Decision Tree classifier followed by the evaluation of three boosting algorithms: XGBoost, LightGBM, and CatBoost, under identical experimental conditions. The best-performing model is subsequently subjected to explainability analysis using SHAP to extract both global and local feature contributions. Finally, performance metrics and error behavior are examined to assess detection effectiveness and operational characteristics. This structured pipeline ensures methodological transparency, reproducibility, and alignment between predictive performance and interpretability-driven operational insight

4.1. Dataset Description and Selection

This study employs the TON_IoT network telemetry dataset to evaluate boosting-based intrusion detection and explainable AI (XAI) analysis in IoT network security. TON_IoT represents a contemporary benchmark collected from a realistic and large-scale IoT/IIoT testbed environment, containing diverse network behaviors and attack events. The present work focuses on the network traffic subset, where each record represents a network flow described by protocol-level indicators, connection state metadata, service-level attributes, DNS/SSL/HTTP-related flags, and traffic statistics such as bytes and packet counts. The task is formulated as binary intrusion detection, using the provided ground-truth label where 0 denotes benign traffic and 1 denotes malicious traffic. Although the dataset also includes an attack category descriptor (type), it was not used for modeling in order to preserve the intended binary classification setting and prevent redundant target leakage into the feature space

4.2. Class Distribution Assessment

The dataset exhibited moderate class imbalance. Prior to de-duplication, malicious traffic (label 1) constituted approximately 76% of instances, while benign traffic (label 0) comprised approximately 24%. This imbalance was preserved during pre-processing to maintain a realistic traffic representation. Rather than applying artificial rebalancing techniques such as over-sampling or under-sampling, the study addressed class asymmetry through the use of class-sensitive evaluation metrics, including precision, recall, and F1-score, with particular emphasis on false negatives due to their critical operational impact in intrusion detection systems. This approach ensures that performance assessment reflects real-world security priorities without distorting the underlying data distribution, thereby enabling a more operationally meaningful evaluation of the intrusion detection models investigated in this study

4.3. Data Cleaning and Integrity Controls

To ensure data quality, reproducibility, and unbiased model evaluation, a series of pre-processing and integrity checks were performed prior to model training. The original dataset contained 211,043 records. Duplicate detection identified 27,462 repeated observations, which were removed to prevent bias introduced by repeated instances and to avoid artificially inflated performance during training and evaluation. After deduplication, the final dataset comprised 183,581 unique records. The dataset was further examined for missing values across all selected features, and no missing entries were observed. As a result, no imputation procedures were required, ensuring uniform feature completeness across all samples. Network identifiers such as source and destination IP addresses were excluded from the modeling feature set. These identifiers can induce unrealistic memorization of host-specific behavior and reduce generalizability. The aim of this study is behavior-based detection grounded in traffic characteristics rather than entity-specific recognition. Finally, the target variable was defined as a binary class label representing normal and malicious traffic. Auxiliary attack descriptors were excluded from the feature set to maintain a strict binary classification setting and prevent leakage of fine-grained taxonomy information into the learning process

4.4. Feature Engineering and Categorical Handling

The dataset contained a mixture of numerical and categorical variables. Since the selected models require numeric input, categorical variables were transformed systematically: Cardinality analysis was conducted to quantify the number of unique categories per categorical feature. One feature, dns_query, exhibited high cardinality (726 unique values), which would have caused substantial dimensional expansion under one-hot encoding and could lead to increased overfitting risk and reduced interpretability. Accordingly, dns_query was excluded to promote generalizable behavioral modeling and clearer explainability. All remaining categorical variables, such as proto, service, conn_state, DNS flags, SSL and HTTP categorical attributes, were encoded using one-hot encoding. This approach avoids imposing artificial ordinal relationships among categories and yields an interpretable feature representation suitable for tree-based learning and SHAP analysis. After encoding, the feature space expanded to 247 predictors. For consistency across libraries and to ensure strict numeric input types, Boolean indicators created during one-hot encoding were converted to integers (0/1). Additionally, due to XGBoost feature-name constraints, which prohibits specific special characters, encoded feature names were sanitized to a uniform indexing scheme during model training; the original feature names were preserved separately to support interpretability and reporting.

4.5. Train–Test Split and Reproducibility

The dataset was partitioned into training and testing subsets using an 80:20 stratified sampling strategy to preserve the original class distribution and mitigate sampling bias. This process yielded 146,864 training instances and 36,717 independent test instances, each represented by 247 features. A fixed random seed was consistently applied throughout the experimental pipeline to ensure strict reproducibility of data partitioning, model training, and SHAP-based interpretability analysis.

4.6. Model Selection and Experimental Design

The experimental framework was designed according to a structured evaluation hierarchy aligned with established intrusion detection assessment practices. First, a classical Decision Tree classifier was implemented as a transparent and inherently interpretable baseline, serving as a reference benchmark against which the performance of ensemble-based methods could be rigorously compared. Second, three state-of-the-art boosting algorithms, XGBoost, LightGBM, and CatBoost, were evaluated to examine the performance gains achievable through gradient boosting paradigms in the IoT intrusion detection context. All models were trained and assessed using identical stratified train–test splits and a consistent set of evaluation metrics to ensure methodological fairness and eliminate confounding variability. The baseline Decision Tree was trained using default hyperparameters to function as a non-optimized reference model. In contrast, the boosting models were configured using stable, widely adopted parameter settings including moderate tree depth, controlled numbers of estimators, and subsampling mechanisms, to achieve robust performance without extensive hyperparameter tuning. This design choice supports the study’s objective of delivering a clean, controlled, and fully reproducible comparative evaluation

4.7. Evaluation Metrics and Error Analysis

Model performance was assessed using both conventional classification metrics and operationally significant evaluation criteria. Specifically, the analysis incorporated Accuracy, Precision, Recall, and F1-score with particular emphasis on the attack class; Receiver Operating Characteristic Area Under the Curve to measure threshold-independent class separability; and the Confusion Matrix, reporting true negatives, false positives, false negatives, and true positives. Within the intrusion detection domain, false negatives, corresponding to undetected attacks, constitute the most critical failure mode due to their direct security implications. Accordingly, false positive and false negative counts were explicitly quantified and comparatively analyzed across all models. This operationally oriented evaluation was further illustrated through an error comparison chart presented in Figure 4(a) and a detailed confusion matrix for the best-performing model shown in Figure 4(b), thereby ensuring that model assessment reflects deployment priorities rather than relying solely on aggregate performance metrics

4.8. Explainability Via SHAP

To address interpretability, a critical requirement for deployment trust and model transparency, SHAP (SHapley Additive exPlanations) was applied to the best-performing classifier identified in the results section, namely LightGBM. SHAP enables both global and local interpretability. Global explanations quantify feature importance and directional influence across the entire dataset, as illustrated in Figure 5. Local explanations provide instance-level interpretations, clarifying why specific network flows are classified as either attack or benign, as presented in Figure 6. Given the computational cost associated with full-scale SHAP evaluation on the entire test set, a representative sampling strategy was adopted for the explainability analysis. A background reference sample of 2,000 training instances was used to estimate baseline expectations, while 5,000 test instances were selected for explanation generation. This approach ensures stable global feature rankings and meaningful local interpretations while maintaining computational efficiency and adhering to established best practices in explainable machine learning research.

5. RESULTS

5.1. Comparative Performance Evaluation

Table 1 presents the quantitative performance comparison between the baseline Decision Tree and the three boosting-based classifiers, XGBoost, LightGBM, and CatBoost. All evaluated models achieved exceptionally high classification accuracy, exceeding 99.7%, indicating strong class separability within the TON_IoT network traffic subset. Nevertheless, closer inspection of the confusion matrix components reveals subtle yet operationally significant differences, particularly in false positive and false negative counts. Among the evaluated approaches, LightGBM achieved the highest overall accuracy of 99.89%, while simultaneously producing the lowest false positive count of 28 and the lowest false negative count of 13. This combination of maximized detection performance and minimized critical error rates establishes LightGBM as the most operationally reliable model within the experimental setting.

5.1.1. Cross-Validation Stability Assessment

To ensure that the reported results are not dependent on a single train–test split, LightGBM was additionally evaluated using 5-fold stratified cross-validation on the training dataset. This supplementary analysis assesses performance stability under varying partitioning of the training data. Table 2 presents the mean and standard deviation across folds for key evaluation metrics.

The extremely low variance across folds demonstrates that model performance is highly consistent and minimally sensitive to data partitioning. The cross-validation results closely align with the hold-out test performance reported in Table 1, confirming that the model’s high accuracy and strong discrimination capability are not artifacts of a particular split. This stability further supports the reliability of the selected boosting-based approach for IoT intrusion detection within the evaluated dataset.

5.2. ROC Curve and Precision-Recall Analysis

To assess threshold-independent discriminative capability, Receiver Operating Characteristic (ROC) curves were generated for all evaluated models, as illustrated in Figure 3(a). The corresponding Area Under the Curve values indicate near-perfect class separability for the boosting-based approaches, substantially outperforming the baseline Decision Tree. The obtained ROC-AUC scores are as follows: Decision Tree achieved 0.9966; XGBoost achieved 0.99998; LightGBM achieved 0.9999876; and CatBoost achieved 0.999905. These results confirm that gradient boosting frameworks provide superior ranking performance and class discrimination capacity within the TON_IoT network traffic subset, with LightGBM exhibiting the strongest overall separability. Although all boosting models achieved extremely high AUC values, LightGBM produced the strongest ranking capability overall. The ROC curves in Figure 3(a) confirm that ensemble boosting improves margin stability relative to a single decision tree. Given the class imbalance of approximately 77% attack traffic, Precision–Recall curves were also examined, as shown in Figure 3(b). The PR curves demonstrate sustained high precision across nearly the entire recall spectrum for the boosting models. This is particularly relevant in intrusion detection contexts, where maintaining high detection rates without excessive false alarms is critical.

5.3. Operational Error and Confusion Matrix Analysis

Although overall accuracy values are high, intrusion detection performance must be evaluated primarily through operational error behavior rather than aggregate accuracy alone. In this context, false negatives (FN) correspond to undetected attacks and represent the most critical security risk, while false positives (FP) correspond to benign traffic incorrectly classified as malicious, contributing to alert fatigue and unnecessary operational overhead. Figure 4(a) presents a comparative analysis of false positive and false negative counts across all evaluated models. Several key observations emerge. LightGBM reduced false negatives by 61.8% relative to the Decision Tree baseline, decreasing from 34 to 13 instances. It also reduced false positives by 40.4% compared to the baseline, decreasing from 47 to 28 instances. When compared to XGBoost, LightGBM further reduced false negatives by 31.6%, from 19 to 13 instances. In contrast, CatBoost exhibited the highest false negative count of 52 despite achieving a near-perfect ROC-AUC score, underscoring that AUC alone does not guarantee optimal performance at the selected decision threshold. Collectively, these findings demonstrate that boosting algorithms deliver not only marginal improvements in overall accuracy but also substantial reductions in critical missed detections, thereby enhancing operational reliability in IoT intrusion detection. Due to its superior operational error profile, LightGBM was selected for further analysis. The confusion matrix shown in Figure 4(b) confirms its robustness, demonstrating only 13 false negatives and 28 false positives while maintaining near-perfect classification performance across both benign and malicious traffic classes.

These results reinforce the model’s suitability for deployment-oriented intrusion detection scenarios where both missed attacks and excessive false alarms must be tightly controlled. It also demonstrates that ensemble boosting effectively stabilizes decision boundaries and reduces misclassification variance compared to a single-tree model.

5.4. Global Explainability Via SHAP

To enhance interpretability and provide global explanations of model behavior, SHAP analysis was performed on the selected LightGBM model. The SHAP summary plot in Figure 5(a) indicates that model predictions are primarily driven by protocol-level indicators such as proto_tcp and proto_udp, port-related features including dst_port and src_port, connection state attributes such as conn_state_REJ, traffic volume metrics including src_pkts, src_bytes, and src_ip_bytes, and DNS-related variables such as dns_rejected_T and dns_qtype.

The global feature importance plot in Figure 5(b) further confirms that proto_tcp is the most influential feature in distinguishing malicious traffic across the dataset. This suggests that TCPbased communication patterns are strongly associated with attack behavior in the TON_IoT network traffic subset, highlighting the dominant role of transport-layer protocols in class separability.

5.5. Local Explainability: Model Strengths and Limitations

To further investigate individual prediction behavior, local SHAP waterfall analyses were performed for both a correctly classified attack instance and a rare false negative case, as illustrated in Figure 6. The true positive explanation shown in Figure 6(a) demonstrates that the prediction is driven by multiple converging feature contributions, including TCP protocol usage, specific destination port characteristics, packet- and byte-level intensity measures, and service-level attributes. This analysis confirms that the LightGBM model integrates a diverse set of behavioral indicators when forming attack predictions rather than relying on a single dominant feature. Such multi-factor decision patterns enhance model robustness and reduce susceptibility to spurious correlations.

In contrast, the false negative explanation presented in Figure 6(b) highlights a limitation of the model. The dominant negative contributor was proto_tcp = 0, indicating the flow was not TCPbased. Combined with proto_udp = 1 and DNS-related indicators, the model strongly biased the prediction toward benign classification. Although certain traffic-intensity features pushed toward malicious classification, their influence was insufficient to overcome protocol-driven bias. This suggests that malicious flows occurring over non-dominant protocols may be under-detected in datasets where attack traffic is heavily TCP-concentrated.

The dominance of protocol-related features observed in the SHAP analysis is consistent with the dataset structure, where attack traffic is largely TCP-based and benign traffic exhibits stronger UDP representation, contributing to class separability while also helping explain the rare UDPrelated misclassification cases.

6. DISCUSSION

6.1. Performance Gains Beyond Accuracy

Although all evaluated models achieved exceptionally high benchmark performance, the comparative analysis demonstrates that boosting-based ensembles offer advantages that extend beyond aggregate accuracy or discrimination metrics. In highly separable IoT traffic datasets, multiple classifiers may converge toward similar headline performance values. However, such convergence does not imply equivalence in classification behavior. Boosting methods progressively correct residual misclassifications, leading to smoother and more stable decision boundaries in heterogeneous traffic conditions. Rather than merely increasing global accuracy, ensemble learning improves the structure and consistency of error distribution, particularly in complex or borderline regions of feature space. This structural refinement enhances robustness in ways that are not fully captured by traditional summary metrics. These findings reinforce an important methodological consideration in intrusion detection research: evaluation must extend beyond accuracy and ROC-based measures to assess the qualitative behavior of model decisions under operationally relevant conditions. In this context, the value of boosting lies in strengthening detection reliability and boundary stability rather than producing superficial metric gains.

6.2. Interpretable Boosting: From Black Box to Transparent IDS

An important aspect of this study is the integration of SHAP-based explainability within a highperformance boosting framework. Ensemble models are often characterized as opaque relative to single-tree classifiers; however, the present analysis demonstrates that their internal reasoning can be systematically examined and validated. Explainability serves a dual purpose. First, it confirms that predictive behavior aligns with semantically meaningful traffic characteristics rather than arbitrary correlations. Second, it provides a mechanism for interrogating model limitations by revealing how specific feature interactions influence prediction confidence in both typical and atypical cases. By incorporating interpretability into the evaluation pipeline, the model transitions from a purely predictive instrument to a transparent analytical system. Importantly, interpretability is not positioned as a cosmetic addition, but as a structural validation layer that strengthens decision accountability and deployment credibility in cybersecurity contexts. Through explanation-driven analysis, model behavior becomes auditable, diagnosable, and defensible, characteristics essential for operational IoT intrusion detection systems.

6.3. Operational Reliability Considerations

IoT environments are inherently characterized by resource constraints, heterogeneous device communication patterns, high volumes of automated traffic, and limited capacity for continuous manual oversight. Within such operational contexts, minimizing false negatives is critical, as undetected attacks can propagate across interconnected devices and compromise entire ecosystems. The comparative analysis revealed meaningful differences in operational error behavior. LightGBM provided the strongest operational reliability by substantially reducing missed detections while maintaining low false alarm rates. In particular, it reduced false negatives by 61.8% relative to the Decision Tree baseline, indicating improved detection stability in borderline or ambiguous traffic flows. This reduction translates directly into lower missed-attack risk, strengthening the practical trustworthiness of the detection system in high-volume IoT environments. Beyond error reduction, SHAP-based interpretability introduces tangible deployment advantages. Security analysts can directly trace which behavioral indicators contribute to alert generation, thereby enhancing transparency and facilitating rapid incident triage. Protocoland service-level patterns identified through global explanations can be translated into complementary rule-based monitoring policies. At the same time, the interpretability analysis revealed structural dependencies in classification behavior, particularly protocol-level dominance in decision formation. While such dominance supports high separability within the evaluated dataset, it may also influence generalization under different traffic compositions. Local explanation of false negative instances demonstrated that specific protocol configurations, such as UDP traffic patterns, can suppress malicious probability contributions, leading to rare misclassifications. Identifying such behavior enables informed mitigation strategies, including protocol-aware monitoring policies, adaptive threshold tuning, and dataset rebalancing strategies. Importantly, operational reliability in this context does not imply formal guarantees of resilience under adversarial manipulation or long-term temporal drift. Rather, it reflects empirical consistency of detection behavior, controlled false negative rates, and interpretability-supported transparency within the evaluated experimental setting. By combining boosting-based ensemble learning with explainable AI, the proposed framework advances not only predictive performance but also deployment-relevant reliability characteristics grounded in measurable operational risk reduction.

6.4. Generalization Considerations

While the reported performance is exceptionally high, external validity should be interpreted conservatively when generalizing these findings to other IoT environments. The pronounced separability observed in this study is partially attributable to the protocol distribution and attack injection characteristics of the evaluated dataset. Consequently, performance outcomes may vary under different traffic compositions or more complex threat landscapes. Future research should therefore examine cross-dataset generalization across benchmarks such as TON_IoT, UNSWNB15, and CICIDS; extend the framework to multi-class attack detection settings; assess robustness under adversarial manipulation; investigate protocol-balanced training strategies; and conduct cross-network validation experiments to evaluate deployment stability under distributional shift. Notwithstanding these considerations, within the experimental scope defined in this study, the findings demonstrate that boosting-based ensemble models combined with SHAP-driven interpretability provide a compelling balance between predictive performance and analytical transparency, supporting their suitability for operational IoT intrusion detection applications.

7. CONCLUSION AND FUTURE WORK

Effective network security is a fundamental requirement in the rapidly evolving IoT landscape, where Intrusion Detection Systems (IDS) play a critical protective role. This study presented a structured and interpretable evaluation of boosting-based machine learning algorithms for binary IoT intrusion detection using the TON_IoT dataset. Following a rigorous preprocessing pipeline, a transparent Decision Tree baseline was systematically compared with XGBoost, LightGBM, and CatBoost under identical experimental conditions. Although all models achieved near-optimal classification performance, meaningful differences emerged in operational error behavior. LightGBM demonstrated the most favorable error profile by reducing missed attacks while maintaining minimal false alarms, and cross-validation confirmed its stability. SHAP-based explainability provided insight into the learned decision structure, identifying dominant traffic indicators and revealing protocol-dependent bias in rare misclassification cases. These findings underscore the value of interpretability in validating operational reliability and exposing structural dependencies beyond aggregate performance metrics. The study contributes by providing a structured comparison of baseline and boosting models, demonstrating that false negative minimization is a more meaningful indicator of operational effectiveness than accuracy alone, and integrating SHAP-based explainability to validate model decision logic. Collectively, the results support a deployment-aware evaluation framework that combines performance benchmarking, interpretability, and operational error analysis for IoT intrusion detection. While the results are encouraging, they are derived from the TON_IoT benchmark and should be interpreted within the scope of the evaluated dataset. The observed performance and SHAP-based explanations may vary under different traffic distributions, attack characteristics, and deployment environments. Further cross-dataset and real-world validation is therefore required to establish broader generalizability. Future work may extend this framework to multiclass intrusion detection, cross-dataset validation, adaptive threshold calibration, and evaluation under evolving traffic distributions.

CONFLICT OF INTEREST

The authors declare no conflict of interest.

ACKNOWLEDGEMENTS

The authors thank the Faculty of Computer Applications, Marwadi University, for academic support.

REFERENCES

[1] S. Mishra and A. K. Tyagi, “The Role of Machine Learning Techniques in Internet of Things-Based Cloud Applications,” in Artificial Intelligence-based Internet of Things Systems, S. Pal, D. De, and R. Buyya, Eds., Cham: Springer International Publishing, 2022, pp. 105–135. doi: 10.1007/978-3-030- 87059-1_4.

[2] H. Mrabet, S. Belguith, A. Alhomoud, and A. Jemai, “A Survey of IoT Security Based on a Layered Architecture of Sensing and Data Analysis,” Sensors, vol. 20, no. 13, p. 3625, 2020, doi: 10.3390/s20133625.

[3] M. Lombardi, F. Pascale, and D. Santaniello, “Internet of Things: A General Overview between Architectures, Protocols and Applications,” Information, vol. 12, no. 2, p. 87, 2021, doi: 10.3390/info12020087.

[4] Y. R. Siwakoti, M. Bhurtel, D. B. Rawat, A. Oest, and R. C. Johnson, “Advances in IoT Security: Vulnerabilities, Enabled Criminal Services, Attacks, and Countermeasures,” IEEE Internet of Things Journal, vol. 10, no. 13, pp. 11224–11239, Jul. 2023, doi: 10.1109/JIOT.2023.3252594.

[5] M. Azrour, J. Mabrouki, A. Guezzaz, and A. Kanwal, “Internet of Things Security: Challenges and Key Issues,” Security and Communication Networks, vol. 2021, no. 1, p. 5533843, Jan. 2021, doi: 10.1155/2021/5533843.

[6] O. H. Abdulganiyu, T. Ait Tchakoucht, and Y. K. Saheed, “A systematic literature review for network intrusion detection system (IDS),” International Journal of Information Security, vol. 22, no. 5, pp. 1125–1162, Oct. 2023, doi: 10.1007/s10207-023-00682-2.

[7] S. Dina and D. Manivannan, “Intrusion detection based on Machine Learning techniques in computer networks,” Internet of Things, vol. 16, p. 100462, Dec. 2021, doi: 10.1016/j.iot.2021.100462.

[8] T. Saranya, S. Sridevi, C. Deisy, T. D. Chung, and M. K. A. A. Khan, “Performance Analysis of Machine Learning Algorithms in Intrusion Detection System: A Review,” Procedia Computer Science, vol. 171, pp. 1251–1260, Jan. 2020, doi: 10.1016/j.procs.2020.04.133.

[9] M. F. Saiyed and I. Al-Anbagi, “A Genetic Algorithm- and t-Test-Based System for DDoS Attack Detection in IoT Networks,” IEEE Access, vol. 12, pp. 25623–25641, 2024, doi: 10.1109/ACCESS.2024.3367357.

[10] Ghourabi, “A Security Model Based on LightGBM and Transformer to Protect Healthcare Systems From Cyberattacks,” IEEE Access, vol. 10, pp. 48890–48903, 2022, doi: 10.1109/ACCESS.2022.3172432.

[11] K. Alissa, T. Alyas, K. Zafar, Q. Abbas, N. Tabassum, and S. Sakib, “Botnet Attack Detection in IoT Using Machine Learning,” Computational Intelligence and Neuroscience, vol. 2022, no. 1, p. 4515642, Jan. 2022, doi: 10.1155/2022/4515642.

[12] D. Rani, N. S. Gill, P. Gulia, F. Arena, and G. Pau, “Design of an Intrusion Detection Model for IoTEnabled Smart Home,” IEEE Access, vol. 11, pp. 52509–52526, 2023, doi: 10.1109/ACCESS.2023.3276863.

[13] M. Usama Tanveer, K. Munir, M. Amjad, H. J. Alyamani, A. Bermak, and A. Ur Rehman, “LightEnsemble-Guard: An Optimized Ensemble Learning Framework for Securing ResourceConstrained IoT Systems,” IEEE Access, vol. 13, pp. 101764–101781, 2025, doi: 10.1109/ACCESS.2025.3576218.

[14] M. Osman, J. He, F. M. M. Mokbal, N. Zhu, and S. Qureshi, “ML-LGBM: A Machine Learning Model Based on Light Gradient Boosting Machine for the Detection of Version Number Attacks in RPLBased Networks,” IEEE Access, vol. 9, pp. 83654–83665, 2021, doi: 10.1109/ACCESS.2021.3087175.

[15] N. Hafsa, H. Alzoubi, and S. Imran, “Machine learning-based intrusion detection and prevention using cross-layer features in Internet of Things (IoT) networks,” Journal of Communications and Networks, vol. 27, no. 5, pp. 345–358, Oct. 2025, doi: 10.23919/JCN.2025.000053.

[16] J. B. Awotunde et al., “An Ensemble Tree-Based Model for Intrusion Detection in Industrial Internet of Things Networks,” Applied Sciences, vol. 13, no. 4, p. 2479, 2023, doi: 10.3390/app13042479.

[17] Q. Abu Al-Haija and M. Al-Dala’ien, “ELBA-IoT: An Ensemble Learning Model for Botnet Attack Detection in IoT Networks,” Journal of Sensor and Actuator Networks, vol. 11, no. 1, p. 18, 2022, doi: 10.3390/jsan11010018.

[18] T. Abid et al., “A novel IoT threat detection using GWO feature selection and CNN-enhanced LightGBM,” Journal of Cloud Computing, vol. 14, no. 1, p. 72, Nov. 2025, doi: 10.1186/s13677-025- 00785-2.

[19] W. Chen, H. Yang, L. Yin, and X. Luo, “Large-scale IoT attack detection scheme based on LightGBM and feature selection using an improved salp swarm algorithm,” Scientific Reports, vol. 14, no. 1, p. 19165, Aug. 2024, doi: 10.1038/s41598-024-69968-2.

[20] Y. Hosain and M. Çakmak, “XAI-XGBoost: an innovative explainable intrusion detection approach for securing internet of medical things systems,” Scientific Reports, vol. 15, no. 1, p. 22278, Jul. 2025, doi: 10.1038/s41598-025-07790-0.

[21] M. Aly and N. M. Alotaibi, “SHAP enhanced transformer GWO boosting model for transparent and robust anomaly detection in IIoT environments,” Scientific Reports, vol. 15, no. 1, p. 41037, Nov. 2025, doi: 10.1038/s41598-025-25033-0.

[22] U. Khan et al., “A Proactive Attack Detection for Heating, Ventilation, and Air Conditioning (HVAC) System Using Explainable Extreme Gradient Boosting Model (XGBoost),” Sensors, vol. 22, no. 23, p. 9235, 2022, doi: 10.3390/s22239235.

[23] N. U. Sama, S. Ullah, S. M. Ahsan Kazmi, and M. Mazzara, “Cutting-Edge Intrusion Detection in IoT Networks: A Focus on Ensemble Models,” IEEE Access, vol. 13, pp. 8375–8392, 2025, doi: 10.1109/ACCESS.2024.3491831.

[24] C. Bentéjac, A. Csörgő, and G. Martínez-Muñoz, “A comparative analysis of gradient boosting algorithms,” Artificial Intelligence Review, vol. 54, no. 3, pp. 1937–1967, Mar. 2021, doi: 10.1007/s10462-020-09896-5.

[25] C. Giraud-Carrier, “Combining Base-Learners into Ensembles,” in Metalearning: Applications to Automated Machine Learning and Data Mining, P. Brazdil, J. N. van Rijn, C. Soares, and J. Vanschoren, Eds., Cham: Springer International Publishing, 2022, pp. 169–188. doi: 10.1007/978-3- 030-67024-5_9.

[26] D. S. Ahmed, K. Q. Hussein, and H. A. A. Abed Allah, “Phishing Websites Detection Model based on Decision Tree Algorithm and Best Feature Selection Method,” Turkish Journal of Computer and Mathematics Education (TURCOMAT), vol. 13, no. 1, pp. 100–107, 2022, doi: 10.17762/turcomat.v13i1.11964.

[27] T. Chen and C. Guestrin, “XGBoost: A Scalable Tree Boosting System,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, in KDD ’16. New York, NY, USA: Association for Computing Machinery, 2016, pp. 785–794. doi: 10.1145/2939672.2939785.

[28] T. Toharudin et al., “Boosting Algorithm to Handle Unbalanced Classification of PM2.5 Concentration Levels by Observing Meteorological Parameters in Jakarta-Indonesia Using AdaBoost, XGBoost, CatBoost, and LightGBM,” IEEE Access, vol. 11, pp. 35680–35696, 2023, doi: 10.1109/ACCESS.2023.3265019.

[29] A. Ibrahim, R. L. Ridwan, M. M. Muhammed, R. O. Abdulaziz, and G. A. Saheed, “Comparison of the CatBoost Classifier with other Machine Learning Methods,” International Journal of Advanced Computer Science and Applications, vol. 11, no. 11, 2020, doi: 10.14569/IJACSA.2020.0111190.

[30] S. AL and S. Sagiroglu, “Explainable artificial intelligence models in intrusion detection systems,” Engineering Applications of Artificial Intelligence, vol. 144, p. 110145, Mar. 2025, doi: 10.1016/j.engappai.2025.110145.

[31] B. Sharma, L. Sharma, C. Lal, and S. Roy, “Explainable artificial intelligence for intrusion detection in IoT networks: A deep learning based approach,” Expert Sys Appl, vol. 238, 2024, doi: 10.1016/j.eswa.2023.121751.

[32] D. Gaspar, P. Silva, and C. Silva, “Explainable AI for Intrusion Detection Systems: LIME and SHAP Applicability on Multi-Layer Perceptron,” IEEE Access, vol. 12, pp. 30164–30175, 2024, doi: 10.1109/ACCESS.2024.3368377.

[33] Barredo Arrieta et al., “Explainable Artificial Intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI,” Information Fusion, vol. 58, pp. 82–115, Jun. 2020, doi: 10.1016/j.inffus.2019.12.012.

[34] K. Roshan and A. Zafar, “Utilizing XAI Technique to Improve Autoencoder Based Model for Computer Network Anomaly Detection with Shapley Additive Explanation (SHAP),” International Journal of Computer Networks & Communications, vol. 13, no. 6, pp. 109–128, Nov. 2021, doi: 10.5121/IJCNC.2021.13607.

[35] S. M. Lundberg et al., “From local explanations to global understanding with explainable AI for trees,” Nature Machine Intelligence, vol. 2, no. 1, pp. 56–67, Jan. 2020, doi: 10.1038/s42256-019-0138-9.

AUTHORS

Enoch Success Boakai received the B.Sc. degree in information technology from Starz University, Monrovia, Liberia, and the M.Sc. degree in cyber security and cyber law from Marwadi University, Rajkot, Gujarat, India, where he is currently pursuing the Ph.D. degree in computer science at the Faculty of Computer Applications. His research interests include the Internet of Things (IoT), cyber security, artificial intelligence, and blockchain

Dr. Sunil Lalchand Bajeja received the B.E. degree in computer engineering from Dharmsinh Desai University (DDIT), Nadiad, Gujarat, in 1997, the M.Sc. degree in information technology in 2010, and the Ph.D. degree in computer science from Saurashtra University in 2016. He is currently an Associate Professor and Head of the Faculty of Computer Applications, Marwadi University, Rajkot, Gujarat, India. His research interests include cloud computing, cybersecurity, digital forensics, machine learning, and computer networks. He has supervised Ph.D. research and authored numerous papers presented at national and international conferences and published in peer-reviewed journals. He is an Active Member of the NEP Implementation Committee, the IDP Committee, the BoS Committee, and serves on a subcommittee to formulate innovative assessment methods.