SHAP-Enhanced Histogram Gradient Boosting for IoT Threat Detection via Signal-Based Network Traffic Analysis
Ahmed A. Mohammed, Ahmed Marwan Aleesa, Ali M. Alhatim · Diyala Journal of Engineering Sciences · 2025
The dramatic rise in the number of Internet of Things (IoT) devices has greatly increased the size of the attack surface of network-based threats, especially high-volume, non-portable DDoS botnet attacks. Our hypothesis is to suggest an explainable intrusion detection system and analyse digital signals of raw IoT network traffic. We train a Histogram-based Gradient Boosting Classifier (HGBC) to identify benign and malicious traffic based on 11 classes (10 attack-related, 1 benign) on the N-BaIoT dataset. To reduce bias, the model has been trained on a strictly pre-processed and balanced subset of the data. We apply SHapley Additive exPlanations (SHAP), a game theory-based framework, to gain insight into complex model predictions that are security-relevant, despite the black-box nature of the model. This SHAP-enhanced method classifies and orders the most significant features, and it is found that mutual information and packet jitter characteristics descriptors (e.g., MI_dir_L0.1_mean) are decisive when identifying coordinated attack actions. The model reported the macro-averaged accuracy, recall and F1-score as 1.00 on a held-out test set. The three contributions of the work can be summarised as: (i) an end-to-end interpretable multi-class IoT DDoS detector; (ii) a transparent data curation framework that tackles imbalance and redundancy; and (iii) empirical support on how HGBC with SHAP can be highly performant yet offer actionable insight into the feature semantics that will inform future security design.