{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,15]],"date-time":"2026-04-15T17:54:46Z","timestamp":1776275686401,"version":"3.50.1"},"reference-count":22,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,2,3]],"date-time":"2026-02-03T00:00:00Z","timestamp":1770076800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T00:00:00Z","timestamp":1772496000000},"content-version":"vor","delay-in-days":28,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100007446","name":"King Khalid University","doi-asserted-by":"publisher","award":["RGP2\/337\/46"],"award-info":[{"award-number":["RGP2\/337\/46"]}],"id":[{"id":"10.13039\/501100007446","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Discov Internet Things"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    The rapid growth of Internet of Things (IoT) devices has significantly increased the cyber-attack surface, rendering traditional centralized Intrusion Detection Systems (IDSs) impractical due to privacy concerns and communication bottlenecks. Federated Learning (FL) has become a privacy-preserving alternative, but most FL-based IDSs function as \u201cblack boxes,\" relying on correlation-based explainability methods that do not reveal the underlying causal mechanisms of attacks. These limitations impede root-cause analysis and the creation of reliable security solutions. This paper introduces a new framework, Causal Explainable Federated Learning for IoT Intrusion Detection (Causal-FL-ID), which integrates causal reasoning directly into the FL process. In this setup, distributed IoT clients perform local causal discovery and send lightweight, privacy-preserving causal summaries to a central server. The server combines these summaries to create a global causal graph, providing deep insights into the causes of an intrusion. This method enables counterfactual reasoning, allowing security analysts to simulate interventions and assess their potential impact on threat mitigation. Extensive experiments on the IDSIoT2024 dataset demonstrate that the proposed framework achieves high prediction accuracy around\n                    <jats:inline-formula>\n                      <jats:tex-math>$$98.5\\%$$<\/jats:tex-math>\n                    <\/jats:inline-formula>\n                    and scales effectively with 10, 25, and 50 clients. The results confirm that Causal-FL-ID not only delivers strong performance with manageable communication costs but also offers stable, transparent, and causally grounded explanations, marking a significant step toward more interpretable and resilient security systems for complex IoT environments.\n                  <\/jats:p>","DOI":"10.1007\/s43926-026-00292-z","type":"journal-article","created":{"date-parts":[[2026,2,3]],"date-time":"2026-02-03T14:16:54Z","timestamp":1770128214000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Explainable federated learning through causal reasoning for intrusion detection in IoT"],"prefix":"10.1007","volume":"6","author":[{"given":"Fatima","family":"Asiri","sequence":"first","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,2,3]]},"reference":[{"issue":"22","key":"292_CR1","doi-asserted-by":"publisher","DOI":"10.3390\/s21227518","volume":"21","author":"S Latif","year":"2021","unstructured":"Latif S, Driss M, Boulila W, Huma ZE, Jamal SS, Idrees Z, et al. Deep learning for the industrial internet of things (iiot): a comprehensive survey of techniques, implementation frameworks, potential applications, and future directions. Sensors. 2021;21(22):7518.","journal-title":"Sensors"},{"issue":"2","key":"292_CR2","doi-asserted-by":"publisher","first-page":"1687","DOI":"10.1007\/s11277-020-07446-4","volume":"114","author":"A Khanna","year":"2020","unstructured":"Khanna A, Kaur S. Internet of things (iot), applications and challenges: a comprehensive review. Wirel Pers Commun. 2020;114(2):1687\u2013762.","journal-title":"Wirel Pers Commun"},{"issue":"2","key":"292_CR3","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11020198","volume":"11","author":"M Abdullahi","year":"2022","unstructured":"Abdullahi M, Baashar Y, Alhussian H, Alwadain A, Aziz N, Capretz LF, et al. Detecting cybersecurity attacks in internet of things using artificial intelligence methods: a systematic literature review. Electronics. 2022;11(2):198.","journal-title":"Electronics"},{"issue":"1","key":"292_CR4","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-019-0038-7","volume":"2","author":"A Khraisat","year":"2019","unstructured":"Khraisat A, Gondal I, Vamplew P, Kamruzzaman J. Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity. 2019;2(1):1\u201322.","journal-title":"Cybersecurity"},{"issue":"10","key":"292_CR5","doi-asserted-by":"publisher","first-page":"10246","DOI":"10.1016\/j.jksuci.2022.10.019","volume":"34","author":"PB Udas","year":"2022","unstructured":"Udas PB, Karim ME, Roy KS. Spider: a shallow pca based network intrusion detection system with enhanced recurrent neural networks. J King Saud Univ-Comput Inf Sci. 2022;34(10):10246\u201372.","journal-title":"J King Saud Univ-Comput Inf Sci"},{"key":"292_CR6","doi-asserted-by":"crossref","unstructured":"Latif S, Ahmad J, Al\u00a0Malwi W, Asiri F, Alnazzawi N, Yang J, Gadekallu TR. Mitigating model poisoning and tampering in consumer iot with hmac in split federated learning. IEEE transactions on consumer electronics. 2025.","DOI":"10.1109\/TCE.2025.3603143"},{"issue":"3","key":"292_CR7","doi-asserted-by":"publisher","first-page":"1622","DOI":"10.1109\/COMST.2021.3075439","volume":"23","author":"DC Nguyen","year":"2021","unstructured":"Nguyen DC, Ding M, Pathirana PN, Seneviratne A, Li J, Poor HV. Federated learning for internet of things: a comprehensive survey. IEEE Commun Surv Tutor. 2021;23(3):1622\u201358.","journal-title":"IEEE Commun Surv Tutor"},{"key":"292_CR8","doi-asserted-by":"crossref","unstructured":"Latif S, Djenouri D, Hernandez-Ramos JL, Skarmeta A, Ahmad J. A lightweight integrity-driven federated learning approach to mitigate poisoning attacks in IoT. In: 2024 IEEE Future Networks World Forum (FNWF). IEEE; 2024: pp. 771\u2013776.","DOI":"10.1109\/FNWF63303.2024.11028863"},{"key":"292_CR9","doi-asserted-by":"crossref","unstructured":"Corbucci L, Guidotti R, Monreale A. Explaining black-boxes in federated learning. In: World conference on explainable artificial intelligence.\u00a0Springer; 2023: pp. 151\u2013163.","DOI":"10.1007\/978-3-031-44067-0_8"},{"key":"292_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2025.101681","volume":"33","author":"J Ahmad","year":"2025","unstructured":"Ahmad J, Latif S, Khan IU, Alshehri MS, Khan MS, Alasbali N, Jiang W. An interpretable deep learning framework for intrusion detection in industrial internet of things. Internet Things. 2025;33: 101681.","journal-title":"Internet Things"},{"issue":"4","key":"292_CR11","doi-asserted-by":"publisher","first-page":"931","DOI":"10.1007\/s10207-023-00674-2","volume":"22","author":"S Bhaskara","year":"2023","unstructured":"Bhaskara S, Rathore SS. Causal effect analysis-based intrusion detection system for iot applications. Int J Inf Secur. 2023;22(4):931\u201346.","journal-title":"Int J Inf Secur"},{"key":"292_CR12","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2025.3571621","author":"Z Zeng","year":"2025","unstructured":"Zeng Z, Zha B, Liu X, Deng X. Causal interpretability methods for iot anomaly traffic detection. IEEE Internet Things J. 2025. https:\/\/doi.org\/10.1109\/JIOT.2025.3571621.","journal-title":"IEEE Internet Things J"},{"key":"292_CR13","unstructured":"Zhao Y, Li M, Lai L, Suda N, Civin D, Chandra V. Federated learning with non-iid data. arXiv preprint. https:\/\/arxiv.org\/abs\/1806.005822018.\u00a0"},{"key":"292_CR14","doi-asserted-by":"publisher","unstructured":"Koppula M, LMI LJ. A Real Time Dataset \"IDSIoT2024\". https:\/\/doi.org\/10.21227\/gfaz-t124 .","DOI":"10.21227\/gfaz-t124"},{"key":"292_CR15","doi-asserted-by":"crossref","unstructured":"Oki A, Ogawa Y, Ota K, Dong M. Evaluation of applying federated learning to distributed intrusion detection systems through explainable ai. IEEE Netw Lett. 2024.","DOI":"10.1109\/LNET.2024.3465516"},{"key":"292_CR16","doi-asserted-by":"crossref","unstructured":"S\u00e1ez-de-C\u00e1mara X, Flores JL, Arellano C, Urbieta A, Zurutuza U. Federated explainability for network anomaly characterization. In: Proceedings of the 26th International symposium on research in attacks, intrusions and defenses. 2023: pp. 346\u2013365.","DOI":"10.1145\/3607199.3607234"},{"key":"292_CR17","doi-asserted-by":"crossref","unstructured":"Kalakoti R, Bahsi H, N\u00f5mm S. Explainable federated learning for botnet detection in iot networks. In: 2024 IEEE International conference on cyber security and resilience (CSR). IEEE; 2024: pp. 1\u20138.","DOI":"10.1109\/CSR61664.2024.10679348"},{"issue":"6","key":"292_CR18","doi-asserted-by":"publisher","DOI":"10.3390\/fi17060234","volume":"17","author":"K Fatema","year":"2025","unstructured":"Fatema K, Dey SK, Anannya M, Khan RT, Rashid MM, Su C, et al. Federated xai ids: an explainable and safeguarding privacy approach to detect intrusion combining federated learning and shap. Future Internet. 2025;17(6):234.","journal-title":"Future Internet"},{"key":"292_CR19","unstructured":"Bilal MA, Islam IU, Iltaf N, Khan MJ, Khan J. Federated learning with explainable ai for malicious traffic detection in iot networks. IEEE Access. 2025."},{"key":"292_CR20","doi-asserted-by":"crossref","unstructured":"Attique D, Hao W, Ping W, Javeed D, Adil M. Ex-dfl: An explainable deep federated-based intrusion detection system for industrial iot. In: 2024 21st International joint conference on computer science and software engineering (JCSSE). IEEE; 2024: pp. 358\u2013364","DOI":"10.1109\/JCSSE61278.2024.10613665"},{"issue":"1","key":"292_CR21","first-page":"1","volume":"21","author":"N Rajagopalan","year":"2025","unstructured":"Rajagopalan N. Federated learning and explainable AI-driven intrusion detection with hyperband optimization. J Comput Virol Hacking Tech. 2025;21(1):1\u201325.","journal-title":"J Comput Virol Hacking Tech"},{"key":"292_CR22","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2023.100965","volume":"24","author":"M Amiri-Zarandi","year":"2023","unstructured":"Amiri-Zarandi M, Karimipour H, Dara RA. A federated and explainable approach for insider threat detection in IoT. Internet Things. 2023;24:100965.","journal-title":"Internet Things"}],"container-title":["Discover Internet of Things"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s43926-026-00292-z","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s43926-026-00292-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s43926-026-00292-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T11:33:33Z","timestamp":1772537613000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s43926-026-00292-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,3]]},"references-count":22,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["292"],"URL":"https:\/\/doi.org\/10.1007\/s43926-026-00292-z","relation":{},"ISSN":["2730-7239"],"issn-type":[{"value":"2730-7239","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,3]]},"assertion":[{"value":"9 October 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 January 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 February 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors declare no competing of interest.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"23"}}