TOCA-IoT: Threshold Optimization and Causal Analysis for IoT Network Anomaly Detection Based on Explainable Random Forest
Ibrahim Gad · Algorithms · 2025
The Internet of Things (IoT) is developing quickly, which has led to the development of new opportunities in many different fields. As the number of IoT devices continues to expand, particularly in transportation and healthcare, the need for efficient and secure operations has become critical. In the next few years, IoT connections will continue to expand across different fields. In contrast, a number of problems require further attention to be addressed to provide safe and effective operations, such as security, interoperability, and standards. This research investigates the efficacy of integrating explainable artificial intelligence (XAI) techniques and causal inference methods to enhance network anomaly detection. This study proposes a robust TOCA-IoT framework that utilizes the linear non-Gaussian acyclic model (LiNGAM) to find causal relationships in network traffic data, thereby improving the accuracy and interpretability of anomaly detection. A refined threshold optimization strategy is employed to address the challenge of selecting optimal thresholds for anomaly classification. The performance of the TOCA-IoT model is evaluated on an IoT benchmark dataset known as CICIoT2023. The results highlight the potential of combining causal discovery with XAI for building more robust and transparent anomaly detection systems. The results showed that the TOCA-IoT framework achieved the highest accuracy of 100% and an F-score of 100% in classifying the IoT attacks.