{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,16]],"date-time":"2026-04-16T16:41:16Z","timestamp":1776357676172,"version":"3.51.2"},"reference-count":38,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T00:00:00Z","timestamp":1757030400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T00:00:00Z","timestamp":1757030400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>Intrusion Detection Systems (IDSs) with a Machine Learning (ML) technique have shown efficacy in securing Internet of Things (IoT) networks in recent years. As cyber threats continue to evolve, IDS have become increasingly reliant on advanced ML and deep learning (DL) techniques to improve detection accuracy. However, the growing complexity of these models often makes it challenging for security analysts to interpret the reasoning behind specific alerts. While extensive research has been conducted on IDS using ML and DL methods, the issue of interpretability remains largely unaddressed. One of the interpretable methods in machine learning is to use model-agnostic interpretation tools that can be applied to any supervised machine learning model. To address this issue, a new hybrid model composed of a lightweight one-dimensional convolutional Neural Network (1D-CNN) is proposed with the interpretation ability of the results in which, resource-constrained IoT devices can execute the proposed model. In the first phase, the SHapley Additive exPlanations (SHAP) technique is used for feature selection to detect the most important features. These features can be considered for redesigning the model by using a smaller set of features and reducing the computation and complexity of the model, leading to the creation of a lighter deep network. After the prediction of the proposed model, to interpret and explain the results and analyze the influential factors in predictions, Agnostic methods are employed both globally(SHAP) and locally(SHAP, LIME) to clarify the reasons for the predictions. Experimental results using the TON-IoT dataset showed accuracy, precision, recall, and F1-score criteria to 0.995, 0.9949, 0.9947, and 0.9947, respectively. Therefore, besides accurately predicting attacks in the area of IoT with high precision and lightweight models, the proposed method increases transparency to assist cybersecurity personnel in gaining a better understanding of IDS judgments.<\/jats:p>","DOI":"10.1186\/s42400-025-00369-2","type":"journal-article","created":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T02:02:00Z","timestamp":1757037720000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["Intrusion detection in the internet of things using convolutional neural networks: an explainable AI approach"],"prefix":"10.1186","volume":"8","author":[{"given":"Fatemeh","family":"Ebrahimi","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7788-6597","authenticated-orcid":false,"given":"Reza","family":"Javidan","sequence":"additional","affiliation":[]},{"given":"Reza","family":"Akbari","sequence":"additional","affiliation":[]},{"given":"Yasin","family":"Hosseini","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,9,5]]},"reference":[{"key":"369_CR1","doi-asserted-by":"crossref","unstructured":"Ables J, Kirby T, Anderson W, Mittal S, Rahimi S, Banicescu I, Seale M (2022) Creating an explainable intrusion detection system using self organizing maps ArXiv abs\/2207.07465","DOI":"10.1109\/SSCI51031.2022.10022255"},{"key":"369_CR2","doi-asserted-by":"publisher","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","volume":"8","author":"A Alsaedi","year":"2020","unstructured":"Alsaedi A, Moustafa N, Tari Z, Mahmood A, Anwar A (2020) TON_IoT telemetry dataset: a new generation dataset of IoT and IIoT for data-driven intrusion detection systems. IEEE Access 8:165130\u2013165150","journal-title":"IEEE Access"},{"key":"369_CR3","doi-asserted-by":"crossref","unstructured":"Amarasinghe K, Manic M, (2018) Improving user trust on deep neural networks based intrusion detection systems, In: Proc 44th Annu Conf IEEE Ind Electron Soc (IECON), pp. 3262\u20133268","DOI":"10.1109\/IECON.2018.8591322"},{"key":"369_CR4","doi-asserted-by":"publisher","unstructured":"Bisharat A, Mubeen M, Bilal M, Abbasi S, (2014) 1D-CNN-IDS: 1D CNN-based intrusion detection system for IIoT, https:\/\/doi.org\/10.48550\/arXiv.2409.08529","DOI":"10.48550\/arXiv.2409.08529"},{"key":"369_CR5","first-page":"1","volume":"9","author":"TM Booij","year":"2021","unstructured":"Booij TM, Chiscop I, Meeuwissen E, Moustafa N, den Hartog FTH (2021) ToN_IoT: The role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion data sets. IEEE Internet Things J 9:1\u20131","journal-title":"IEEE Internet Things J"},{"key":"369_CR6","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-024-19695-7","author":"Z Cao","year":"2024","unstructured":"Cao Z, Zhao A, Shang W et al (2024) Using the ToN-IoT dataset to develop a new intrusion detection system for industrial IoT devices. Multimed Tools Appl. https:\/\/doi.org\/10.1007\/s11042-024-19695-7","journal-title":"Multimed Tools Appl"},{"key":"369_CR7","doi-asserted-by":"publisher","unstructured":"Chalichalamala S, Govindan N, Kasarapu R, (2023) A comprehensive analysis of intrusion detection in internet of things (IoT), https:\/\/doi.org\/10.1109\/aikiie60097.2023.10390177","DOI":"10.1109\/aikiie60097.2023.10390177"},{"issue":"8","key":"369_CR8","doi-asserted-by":"publisher","first-page":"425","DOI":"10.3390\/info15080425","volume":"15","author":"A Coscia","year":"2024","unstructured":"Coscia A, Iannacone A, Maci A, Stamerra A (2024) SINNER: a reward-sensitive algorithm for imbalanced malware classification using neural networks with experience replay. Information 15(8):425","journal-title":"Information"},{"key":"369_CR9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102846","volume":"121","author":"F Demirk\u0131ran","year":"2022","unstructured":"Demirk\u0131ran F, \u00c7ay\u0131r A, \u00dcnal U, Da\u011f H (2022) An ensemble of pre-trained transformer models for imbalanced multiclass malware classification. Comput Secur 121:102846","journal-title":"Comput Secur"},{"key":"369_CR10","doi-asserted-by":"publisher","DOI":"10.1186\/s13677-018-0123-6","author":"M Elrawy","year":"2018","unstructured":"Elrawy M, Awad A, Hamed H (2018) Intrusion detection systems for IoT-based smart environments: a survey. J Cloud Comp. https:\/\/doi.org\/10.1186\/s13677-018-0123-6","journal-title":"J Cloud Comp"},{"key":"369_CR11","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3120626","author":"G Gad","year":"2021","unstructured":"Gad G, Abdallah N, Ahmed T (2021) Intrusion detection system using machine learning for vehicular Ad Hoc networks based on ToN-IoT dataset. IEEE Access. https:\/\/doi.org\/10.1109\/ACCESS.2021.3120626","journal-title":"IEEE Access"},{"key":"369_CR12","doi-asserted-by":"crossref","unstructured":"Gendreau AA, Moorman M, (2016) Survey of intrusion detection systems towards an end to end secure internet of things, In: 2016 IEEE 4th International Conference on Future Internet of Things and Cloud(FiCloud). IEEE, Vienna. pp. 84\u201390","DOI":"10.1109\/FiCloud.2016.20"},{"key":"369_CR13","doi-asserted-by":"crossref","unstructured":"Guo G, Pan X, Liu H, Lie F, (2023) An IoT Intrusion detection system based on TON IoT network dataset, IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC): pp. 0333\u20130338","DOI":"10.1109\/CCWC57344.2023.10099144"},{"key":"369_CR14","doi-asserted-by":"publisher","first-page":"100077","DOI":"10.1016\/j.teler.2023.100077","volume":"11","author":"V Hnamte","year":"2023","unstructured":"Hnamte V, Hussain J (2023) Dependable intrusion detection system using deep convolutional neural network: a novel framework and performance evaluation approach. Telematics Inform Rep. 11:100077. https:\/\/doi.org\/10.1016\/j.teler.2023.100077","journal-title":"Telematics Inform Rep."},{"key":"369_CR15","doi-asserted-by":"publisher","first-page":"1164","DOI":"10.1109\/OJCOMS.2022.3188750","volume":"3","author":"ZAE Houda","year":"2022","unstructured":"Houda ZAE, Brik B, Khoukhi L (2022) Why should i trust your IDS\u202f? \u201c: an explainable deep learning framework for intrusion detection systems in internet of things networks. IEEE Open J Commun Society 3:1164\u20131176","journal-title":"IEEE Open J Commun Society"},{"key":"369_CR16","doi-asserted-by":"crossref","unstructured":"Karatas G, Demir O, Sahingoz OK, (2018) Deep Learning in Intrusion Detection Systems. In: 2018 International Congress on Big Data, Deep Learning and Fighting Cyber Terrorism (IBIGDELFT), pp. 113\u2013116","DOI":"10.1109\/IBIGDELFT.2018.8625278"},{"issue":"13","key":"369_CR17","doi-asserted-by":"publisher","first-page":"11604","DOI":"10.1109\/JIOT.2021.3130156","volume":"9","author":"IA Khan","year":"2022","unstructured":"Khan IA, Moustafa N, Pi D, Sallam KM, Zomaya AY, Li B (2022) A new explainable deep learning framework for cyber threat discovery in industrial IoT networks. IEEE Internet Things J 9(13):11604\u201311613","journal-title":"IEEE Internet Things J"},{"issue":"3","key":"369_CR18","doi-asserted-by":"publisher","first-page":"1999","DOI":"10.1007\/s00500-019-04030-2","volume":"24","author":"M Lotfollahi","year":"2020","unstructured":"Lotfollahi M, Jafari Siavoshani M, Shirali Hossein Zade R, Saberian M (2020) Deep packet: a novel approach for encrypted traffic classification using deep learning. Soft Comput 24(3):1999\u20132012","journal-title":"Soft Comput"},{"key":"369_CR19","unstructured":"Lundberg SM, Lee S, (2017) A unified approach to interpreting model predictions, Adv neural inform process syst"},{"key":"369_CR20","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/6634811","author":"B Mahbooba","year":"2021","unstructured":"Mahbooba B, Timilsina M, Sahal R, Serrano M (2021) Explainable artificial intelligence (XAI) to enhance trust management in intrusion detection systems using decision tree model. Complexity. https:\/\/doi.org\/10.1155\/2021\/6634811","journal-title":"Complexity"},{"key":"369_CR21","unstructured":"Mane S, Rao D (2021) Explaining network intrusion detection system using explainable AI framework, arXiv: 2103.07110"},{"key":"369_CR22","doi-asserted-by":"publisher","first-page":"112392","DOI":"10.1109\/ACCESS.2022.3216617","volume":"10","author":"S Neupane","year":"2022","unstructured":"Neupane S, Ables J, Anderson W, Mittal S (2022) Explainable intrusion detection systems (X-IDS): a survey of current methods, challenges, and opportunities. IEEE Access 10:112392\u2013112415","journal-title":"IEEE Access"},{"key":"369_CR23","doi-asserted-by":"crossref","unstructured":"Nguyen QP, Lim KW, Divakaran DM, Low KH, Gee M Ch Chan (2019) A gradient-based explainable variational autoencoder for network anomaly detection, 2019 IEEE Conference on Communications and Network Security (CNS), pp. 91\u201399","DOI":"10.1109\/CNS.2019.8802833"},{"key":"369_CR24","doi-asserted-by":"crossref","first-page":"1890","DOI":"10.11591\/ijece.v14i2.pp1890-1898","volume":"14","author":"N Nisha","year":"2024","unstructured":"Nisha N, Nasib SG, Preeti G (2024) A review on machine learning based intrusion detection system for internet of things enabled environment. Int J Electric Comput Eng 14:1890\u20131898","journal-title":"Int J Electric Comput Eng"},{"issue":"19","key":"369_CR25","doi-asserted-by":"publisher","first-page":"3079","DOI":"10.3390\/electronics11193079","volume":"11","author":"S Patil","year":"2022","unstructured":"Patil S, Varadarajan V, Mazhar SM, Sahibzada A, Ahmed N, Sinha O, Kumar S, Shaw K, Kotecha K (2022) Explainable artificial intelligence for intrusion detection system. Electronics 11(19):3079","journal-title":"Electronics"},{"key":"369_CR26","doi-asserted-by":"publisher","DOI":"10.1080\/08839514.2021.1975393","author":"CY Peng","year":"2021","unstructured":"Peng CY, Park YJ (2021) A new hybrid under-sampling approach to imbalanced classification problems. Appl Artificial Intell. https:\/\/doi.org\/10.1080\/08839514.2021.1975393","journal-title":"Appl Artificial Intell"},{"key":"369_CR27","doi-asserted-by":"crossref","unstructured":"Roshan K Zafar A. (2021) Utilizing XAI technique to improve autoencoder based model for computer network anomaly detection with shapley additive explanation(SHAP), ArXiv\u00a0abs\/2112.08442","DOI":"10.5121\/ijcnc.2021.13607"},{"key":"369_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/j.bdr.2022.100359","author":"M Sarhan","year":"2021","unstructured":"Sarhan M, Layeghy S, Portmann M (2021) Evaluating standard feature sets towards increased generalisability and explainability of ML-based network intrusion detection. Big Data Res. https:\/\/doi.org\/10.1016\/j.bdr.2022.100359","journal-title":"Big Data Res"},{"key":"369_CR29","doi-asserted-by":"publisher","first-page":"121751","DOI":"10.1016\/j.eswa.2023.121751","volume":"238","author":"B Sharma","year":"2024","unstructured":"Sharma B, Sharma L, Lal C, Roy S (2024) Explainable artificial intelligence for intrusion detection in IoT networks: a deep learning based approach. Expert Syst Appl 238:121751","journal-title":"Expert Syst Appl"},{"key":"369_CR30","doi-asserted-by":"publisher","first-page":"11459","DOI":"10.1007\/s00521-023-08319-0","volume":"35","author":"S Sivamohan","year":"2023","unstructured":"Sivamohan S, Sridhar S (2023) An optimized model for network intrusion detection systems in industry 4.0 using XAI based Bi-LSTM framework. Neural Comput Applic 35:11459\u201311475","journal-title":"Neural Comput Applic"},{"key":"369_CR31","doi-asserted-by":"crossref","unstructured":"TABASSUM S, Sabrina, Parvin N, Hossain N (2022) Network attack detection using XAI and reliability analysis. In: 2022 25th International Conference on Computer and Information Technology (ICCIT). IEEE, p. 176\u2013181","DOI":"10.1109\/ICCIT57492.2022.10055236"},{"key":"369_CR32","doi-asserted-by":"crossref","unstructured":"Thereza N, Ramli K(2023) Development of Intrusion detection models for IoT networks utilizing CICIoT2023 Dataset","DOI":"10.1109\/ICON-SONICS59898.2023.10435006"},{"issue":"12","key":"369_CR33","doi-asserted-by":"publisher","first-page":"317","DOI":"10.3390\/info9120317","volume":"9","author":"D Vincenzo","year":"2018","unstructured":"Vincenzo D, Impedovo D, Pirlo G (2018) LICIC: less important components for imbalanced multiclass classification. Information 9(12):317","journal-title":"Information"},{"key":"369_CR34","doi-asserted-by":"publisher","unstructured":"Wali S, Khan I (2021) Explainable AI and random forest based reliable intrusion detection system, https:\/\/doi.org\/10.36227\/techrxiv.17169080.v1","DOI":"10.36227\/techrxiv.17169080.v1"},{"key":"369_CR35","doi-asserted-by":"publisher","first-page":"73127","DOI":"10.1109\/ACCESS.2020.2988359","volume":"8","author":"M Wang","year":"2020","unstructured":"Wang M, Zheng K, Yang Y, Wang X (2020) An explainable machine learning framework for intrusion detection systems. IEEE Access 8:73127\u201373141","journal-title":"IEEE Access"},{"key":"369_CR36","doi-asserted-by":"publisher","first-page":"525","DOI":"10.3390\/make3030027","volume":"3","author":"MR Zafar","year":"2021","unstructured":"Zafar MR, Khan N (2021) Deterministic local interpretable model-agnostic explanations for stable explainability. Mach Learn Knowledge Extract 3:525\u2013541","journal-title":"Mach Learn Knowledge Extract"},{"key":"369_CR37","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-021-01321-9","author":"J Zhai","year":"2021","unstructured":"Zhai J, Qi J, Zhang S (2021) Imbalanced data classification based on diverse sample generation and classifier fusion. Int J Mach Learn Cybernetics. https:\/\/doi.org\/10.1007\/s13042-021-01321-9","journal-title":"Int J Mach Learn Cybernetics"},{"key":"369_CR38","doi-asserted-by":"publisher","first-page":"104034","DOI":"10.1016\/j.cose.2024.104034","volume":"146","author":"A Zohourian","year":"2024","unstructured":"Zohourian A, Dadkhah S, Molyneaux H, Euclides HN, Ghorbani A (2024) IoT-PRIDS: Leveraging packet representations for intrusion detection in IoT networks. Computers Security 146:104034","journal-title":"Computers Security"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00369-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00369-2\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00369-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T02:02:12Z","timestamp":1757037732000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-025-00369-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,5]]},"references-count":38,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["369"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00369-2","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,5]]},"assertion":[{"value":"12 September 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 January 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 September 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that there are no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"66"}}