{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,28]],"date-time":"2026-01-28T20:17:11Z","timestamp":1769631431440,"version":"3.49.0"},"reference-count":37,"publisher":"PeerJ","license":[{"start":{"date-parts":[[2026,1,28]],"date-time":"2026-01-28T00:00:00Z","timestamp":1769558400000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100007613","name":"Majmaah University","doi-asserted-by":"crossref","award":["R-2025-2136"],"award-info":[{"award-number":["R-2025-2136"]}],"id":[{"id":"10.13039\/501100007613","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"abstract":"<jats:p>Industrial Internet of Things (IIoT) systems are becoming increasingly complex and critical, necessitating cybersecurity solutions that are accurate, Interpretable, adaptable, and real-time. To create a cohesive framework for cyber threat detection in IIoT networks, this study proposes a unified framework using the Predict, Explain, and Adapt (PEA) architecture for cyber threat detection in IIoT networks. The proposed framework integrates convolutional neural networks (CNN), long short-term memory (LSTM) networks, and local interpretable model-agnostic explanations (LIME) to deliver a comprehensive, explainable, and dynamic cybersecurity solution. The detection pipeline gains explainability from LIME, which turns decisions made by deep learning models that lack transparency or interpretability into feature-driven, accessible insights for analysts. Synthetic minority over-sampling technique (SMOTE) efficiently reduces class imbalance. On the test set, the proposed hybrid model demonstrated strong prediction abilities achieving an accuracy of 0.962, a recall of 0.947, a precision of 0.951, and an F1-score of 0.955. Five-fold cross-validation yielded consistent findings with an accuracy of 0.969, recall of 0.955, precision of 0.961, and F1-score of 0.958, demonstrating the model\u2019s dependability and efficacy across a range of evaluation measures. The framework supports real-time adaptability, learning from evolving threat landscapes to refine its detection capabilities dynamically. This integration of deep learning, interpretability, and adaptive intelligence advances the frontier of trustworthy, autonomous cybersecurity in IIoT ecosystems. The study employs a systematic pipeline encompassing data preprocessing, class balancing, model training, evaluation, and interpretability analysis, ensuring a comprehensive and reproducible framework.<\/jats:p>","DOI":"10.7717\/peerj-cs.3454","type":"journal-article","created":{"date-parts":[[2026,1,28]],"date-time":"2026-01-28T08:19:13Z","timestamp":1769588353000},"page":"e3454","source":"Crossref","is-referenced-by-count":0,"title":["Explainable deep learning with CNN-LSTM and LIME for securing IIoT ecosystems"],"prefix":"10.7717","volume":"12","author":[{"given":"Shailendra","family":"Mishra","sequence":"first","affiliation":[{"name":"Department of Computer Engineering, College of Computer and Information Sciences, Majmaah University, Al Majmaah, Saudi Arabia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ebtesam Abdulaziz","family":"Almutairi","sequence":"additional","affiliation":[{"name":"Department of Information Technology, College of Computer and Information Sciences, Majmaah University, Al Majmaah, Saudi Arabia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Reem","family":"Alshenaifi","sequence":"additional","affiliation":[{"name":"Department of Information Technology, College of Computer and Information Sciences, Majmaah University, Al Majmaah, Saudi Arabia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"4443","published-online":{"date-parts":[[2026,1,28]]},"reference":[{"key":"10.7717\/peerj-cs.3454\/ref-1","doi-asserted-by":"publisher","first-page":"102647","DOI":"10.1016\/j.rineng.2024.102647","article-title":"Securing modern power systems: implementing comprehensive strategies to enhance resilience and reliability against cyber-attacks","volume":"102647","author":"Abdelkader","year":"2024","journal-title":"Results in Engineering"},{"issue":"1","key":"10.7717\/peerj-cs.3454\/ref-2","doi-asserted-by":"publisher","first-page":"53","DOI":"10.1007\/s10207-024-00951-8","article-title":"On the adoption and deployment of secure and privacy-preserving IIoT in smart manufacturing","volume":"24","author":"Abdullahi","year":"2025","journal-title":"International Journal of Information Security"},{"issue":"6","key":"10.7717\/peerj-cs.3454\/ref-3","doi-asserted-by":"publisher","first-page":"101272","DOI":"10.1016\/j.iot.2024.101272","article-title":"The computing continuum: from IoT to the cloud","volume":"27","author":"Al-Dulaimy","year":"2024","journal-title":"Internet of Things"},{"key":"10.7717\/peerj-cs.3454\/ref-4","doi-asserted-by":"publisher","first-page":"34800","DOI":"10.1109\/ACCESS.2024.3372187","article-title":"A situation-based predictive approach for cybersecurity intrusion detection and prevention","volume":"12","author":"Al-Quayed","year":"2024","journal-title":"IEEE Access"},{"issue":"1","key":"10.7717\/peerj-cs.3454\/ref-5","doi-asserted-by":"publisher","first-page":"67537","DOI":"10.1109\/ACCESS.2024.3394848","article-title":"Scrutinizing security in industrial control systems: an architectural vulnerabilities and communication network perspective","volume":"12","author":"Aslam","year":"2024","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.3454\/ref-6","doi-asserted-by":"crossref","first-page":"100936","DOI":"10.1016\/j.iot.2023.100936","article-title":"Enhancing IoT network security through deep learning-powered intrusion detection system","volume":"24","author":"Bakhsh","year":"2023","journal-title":"Internet of Things"},{"key":"10.7717\/peerj-cs.3454\/ref-7","doi-asserted-by":"publisher","first-page":"377","DOI":"10.1007\/978-3-031-17551-0_25","article-title":"An intrusion detection system based on deep belief networks","volume-title":"Science of Cyber Security\u2013SciSec 2022 (Lecture Notes in Computer Science)","volume":"13580","author":"Belarbi","year":"2022"},{"issue":"4","key":"10.7717\/peerj-cs.3454\/ref-8","doi-asserted-by":"publisher","first-page":"687","DOI":"10.3390\/electronics13040687","article-title":"Enhancing industrial IoT network security through blockchain integration","volume":"13","author":"Bobde","year":"2024","journal-title":"Electronics"},{"key":"10.7717\/peerj-cs.3454\/ref-9","doi-asserted-by":"publisher","DOI":"10.21227\/ykpn-jx78","article-title":"CICIDS2017 and UNBSW-NB15","author":"Chen","year":"2023"},{"key":"10.7717\/peerj-cs.3454\/ref-10","article-title":"Dataset","author":"CIC-IDS","year":"2017"},{"key":"10.7717\/peerj-cs.3454\/ref-11","article-title":"The future of cybersecurity in the IIoT","author":"Cisco","year":"2022"},{"issue":"1","key":"10.7717\/peerj-cs.3454\/ref-12","doi-asserted-by":"publisher","first-page":"12077","DOI":"10.1038\/s41598-024-62861-y","article-title":"Using machine learning algorithms to enhance IoT system security","volume":"14","author":"El-Sofany","year":"2024","journal-title":"Scientific Reports"},{"issue":"22","key":"10.7717\/peerj-cs.3454\/ref-13","doi-asserted-by":"publisher","first-page":"4440","DOI":"10.3390\/electronics13224440","article-title":"Network-based intrusion detection for industrial and robotics systems: a comprehensive survey","volume":"13","author":"Holdbrook","year":"2024","journal-title":"Electronics"},{"key":"10.7717\/peerj-cs.3454\/ref-14","article-title":"AI for industrial IoT security: protecting your assets","author":"IBM","year":"2020"},{"issue":"6","key":"10.7717\/peerj-cs.3454\/ref-15","doi-asserted-by":"publisher","first-page":"e1772","DOI":"10.7717\/peerj-cs.1772","article-title":"Cyberterrorism as a global threat: a review on repercussions and countermeasures","volume":"10","author":"Iftikhar","year":"2024","journal-title":"PeerJ Computer Science"},{"issue":"23","key":"10.7717\/peerj-cs.3454\/ref-16","doi-asserted-by":"publisher","first-page":"7440","DOI":"10.3390\/s24237440","article-title":"A secure IIoT environment that integrates AI-driven real-time short-term active and reactive load forecasting with anomaly detection: a real-world application","volume":"24","author":"Joha","year":"2024","journal-title":"Sensors"},{"issue":"2","key":"10.7717\/peerj-cs.3454\/ref-17","doi-asserted-by":"crossref","first-page":"254","DOI":"10.47392\/IRJAEH.2024.0041","article-title":"A comprehensive study on CIC-IDS2017 dataset for intrusion detection systems","volume":"2","author":"Khan","year":"2024","journal-title":"International Research Journal on Advanced Engineering Hub (IRJAEH)"},{"key":"10.7717\/peerj-cs.3454\/ref-18","article-title":"BPSAC: A Blockchain and PUF-Enabled Security Architecture With C-IDS for Maritime Intelligent Transportation Systems","author":"Liu","year":"2025","journal-title":"IEEE Transactions on Intelligent Transportation Systems"},{"issue":"3","key":"10.7717\/peerj-cs.3454\/ref-19","doi-asserted-by":"publisher","first-page":"1765","DOI":"10.11591\/ijeecs.v39.i3.pp1765-1775","article-title":"GRU\u2013CNN hybrid model for intrusion detection in industrial IoT networks","volume":"39","author":"Mahesh","year":"2025","journal-title":"Indonesian Journal of Electrical Engineering and Computer Science"},{"issue":"2\u20133","key":"10.7717\/peerj-cs.3454\/ref-20","doi-asserted-by":"publisher","first-page":"294","DOI":"10.1016\/j.comcom.2023.06.020","article-title":"Cybersecurity for Industrial IoT (IIoT): threats, countermeasures, challenges and future directions","volume":"208","author":"Mekala","year":"2023","journal-title":"Computer Communications"},{"key":"10.7717\/peerj-cs.3454\/ref-21","first-page":"129","article-title":"Industry 4.0: Industrial Internet of Things (IIoT)","volume-title":"Advances in computers","volume":"117","author":"Munirathinam","year":"2020"},{"issue":"7","key":"10.7717\/peerj-cs.3454\/ref-22","doi-asserted-by":"publisher","first-page":"102777","DOI":"10.1016\/j.asej.2024.102777","article-title":"A deep learning-based novel hybrid CNN-LSTM architecture for efficient detection of threats in the IoT ecosystem","volume":"15","author":"Nazir","year":"2024","journal-title":"Ain Shams Engineering Journal"},{"key":"10.7717\/peerj-cs.3454\/ref-23","article-title":"Cybersecurity framework for IIoT","author":"NIST","year":"2021"},{"issue":"6","key":"10.7717\/peerj-cs.3454\/ref-24","doi-asserted-by":"publisher","first-page":"3121","DOI":"10.3390\/app15063121","article-title":"Cyberattack detection systems in IIoT networks in big data environments","volume":"15","author":"Orman","year":"2025","journal-title":"Applied Sciences"},{"issue":"23","key":"10.7717\/peerj-cs.3454\/ref-25","doi-asserted-by":"publisher","first-page":"4611","DOI":"10.3390\/electronics13234611","article-title":"Leveraging AI for network threat detection\u2014a conceptual overview","volume":"13","author":"Paracha","year":"2024","journal-title":"Electronics"},{"key":"10.7717\/peerj-cs.3454\/ref-26","doi-asserted-by":"publisher","first-page":"100644","DOI":"10.1016\/j.eij.2025.100644","article-title":"Advanced AI-driven intrusion detection for cloud-based IIoT","volume":"30","author":"Qureshi","year":"2025","journal-title":"Egyptian Informatics Journal"},{"key":"10.7717\/peerj-cs.3454\/ref-27","doi-asserted-by":"publisher","first-page":"34720","DOI":"10.1109\/ACCESS.2024.3371996","article-title":"SmartSentry: cyber threat intelligence in industrial IoT","volume":"12","author":"Sadhwani","year":"2024","journal-title":"IEEE Access"},{"issue":"4","key":"10.7717\/peerj-cs.3454\/ref-28","doi-asserted-by":"publisher","first-page":"2967","DOI":"10.3390\/ai5040143","article-title":"Machine learning-based network anomaly detection: design, implementation, and evaluation","volume":"5","author":"Schummer","year":"2024","journal-title":"AI"},{"issue":"20","key":"10.7717\/peerj-cs.3454\/ref-29","doi-asserted-by":"publisher","first-page":"109143","DOI":"10.1016\/j.engappai.2024.109143","article-title":"A comprehensive survey on concept drift and feature dynamics in IDS","volume":"137","author":"Shyaa","year":"2024","journal-title":"Engineering Applications of Artificial Intelligence"},{"issue":"15","key":"10.7717\/peerj-cs.3454\/ref-30","doi-asserted-by":"publisher","first-page":"26608","DOI":"10.1109\/ACCESS.2025.3538461","article-title":"Intrusion detection and prevention system (IDPS) for IIoT using a hybrid framework","volume":"13","author":"Srinivasan","year":"2025","journal-title":"IEEE Access"},{"issue":"3","key":"10.7717\/peerj-cs.3454\/ref-31","doi-asserted-by":"publisher","first-page":"100604","DOI":"10.1016\/j.jii.2024.100604","article-title":"Industry 4.0 data security: a cybersecurity frameworks review","volume":"39","author":"Toussaint","year":"2024","journal-title":"Journal of Industrial Information Integration"},{"issue":"2","key":"10.7717\/peerj-cs.3454\/ref-32","doi-asserted-by":"publisher","first-page":"280","DOI":"10.1016\/j.dcan.2024.02.007","article-title":"Integration of data science with the intelligent IoT (IIoT): current challenges and future perspectives","volume":"11","author":"Ullah","year":"2024","journal-title":"Digital Communications and Networks"},{"key":"10.7717\/peerj-cs.3454\/ref-33","doi-asserted-by":"publisher","first-page":"2490","DOI":"10.1109\/OJCOMS.2024.3386872","article-title":"Explainable AI for 6G use cases: technical aspects and research challenges","volume":"5","author":"Wang","year":"2024","journal-title":"IEEE Open Journal of the Communications Society"},{"issue":"1","key":"10.7717\/peerj-cs.3454\/ref-34","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3482987","article-title":"Leveraging machine learning for cybersecurity resilience in Industry 4.0: challenges and future directions","volume":"12","author":"Yu","year":"2024","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.3454\/ref-35","doi-asserted-by":"publisher","first-page":"107315","DOI":"10.1016\/j.comnet.2020.107315","article-title":"An effective convolutional neural network based on SMOTE and Gaussian mixture model for intrusion detection in imbalanced dataset","volume":"177","author":"Zhang","year":"2020","journal-title":"Computer Networks"},{"issue":"19","key":"10.7717\/peerj-cs.3454\/ref-36","doi-asserted-by":"crossref","first-page":"4170","DOI":"10.3390\/electronics12194170","article-title":"A network intrusion detection model based on BiLSTM with multi-head attention mechanism","volume":"12","author":"Zhang","year":"2023","journal-title":"Electronics"},{"issue":"1","key":"10.7717\/peerj-cs.3454\/ref-37","doi-asserted-by":"publisher","first-page":"213","DOI":"10.3390\/s25010213","article-title":"Cybersecurity solutions for industrial internet of things-edge computing integration: challenges, threats, and future directions","volume":"25","author":"Zhukabayeva","year":"2025","journal-title":"Sensors"}],"container-title":["PeerJ Computer Science"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/peerj.com\/articles\/cs-3454.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-3454.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-3454.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-3454.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,28]],"date-time":"2026-01-28T08:19:19Z","timestamp":1769588359000},"score":1,"resource":{"primary":{"URL":"https:\/\/peerj.com\/articles\/cs-3454"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,28]]},"references-count":37,"alternative-id":["10.7717\/peerj-cs.3454"],"URL":"https:\/\/doi.org\/10.7717\/peerj-cs.3454","archive":["CLOCKSS","LOCKSS","Portico"],"relation":{},"ISSN":["2376-5992"],"issn-type":[{"value":"2376-5992","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,28]]},"article-number":"e3454"}}