XAI-IDS: An Explainable Intrusion Detection Framework for IoT-Enabled Smart Energy Infrastructure

Abstract

The digitalization of energy infrastructure exposes resource-constrained IoT field devices — smart meters, renewable energy sensors, and building automation nodes — to escalating network intrusion threats, making lightweight and interpretable detection a critical operational requirement. This work presents XAI-IDS, a framework combining Random Forest, XGBoost, and LightGBM with SHAP TreeExplainer to deliver global, local, and per-class feature-level explanations on the RT-IoT2022 benchmark.

All three models achieve macro F1 above 0.98; McNemar's test confirms that pairwise accuracy differences are statistically non-significant (p > 0.05), shifting the primary deployment concern to computational cost rather than predictive performance. A four-feature SHAP consensus — forward payload minimum, destination port, average forward payload, and packet rate — maps directly onto the flow statistics that deviate under attacks targeting IoT protocols such as MQTT. SHAP-guided feature selection reduces input dimensionality by 88% with a macro F1 loss below 0.007, supporting deployment on constrained IoT edge gateways.

Key Results

Core Contributions

• 1 A multi-model SHAP analysis across RF, XGBoost, and LightGBM on RT-IoT2022, comprising global importance rankings, local per-prediction explanations, per-class feature decompositions, and a cross-model consistency study.
• 2 A SHAP-guided progressive feature selection study demonstrating that a 10-feature LightGBM model retains macro F1 within 0.007 of the full-feature baseline at 88% dimensionality reduction.
• 3 A paired statistical analysis (McNemar's test) and computational profiling that together provide a data-driven basis for deployment decisions on resource-constrained IoT edge hardware.

Performance Summary

Selected Figures