ANOMALY DETECTION IN INTERNET OF THINGS NETWORKS USING EXPLAINABLE DEEP LEARNING TECHNIQUES

The proliferation of the Internet of Things (IoT) increases interconnectivity across homes, healthcare, manufacturing, transportation and other cyber-physical systems, while also expanding the attack surface of those networks. This paper reports an implemented and evaluated explainable deep-learning detector for anomalies in IoT network traffic. The study uses the CICIoT2023 corpus of the Canadian Institute for Cybersecurity. After cleaning, label encoding, z-score normalisation fitted on the training partition only, Extra Trees feature selection and training-set class balancing, a stacked Gated Recurrent Unit (GRU) classifier was trained on sliding windows of length 10. The trained network performs 34-class traffic attribution and is also mapped to a binary benign-versus-anomalous decision. SHapley Additive exPlanations (SHAP) were computed after training to obtain global feature rankings and local explanations of individual alerts. On the held-out test set the implemented GRU attained 97.56% accuracy, 97.41% weighted precision, 97.56% weighted recall, 97.42% weighted F1-score and a Cohen kappa of 0.9736. Family-level analysis shows that flooding classes are detected reliably, whereas reconnaissance, spoofing, web-based and brute-force traffic remain the hardest minority groups. The same train/test split was used to train Random Forest, deep neural network, convolutional and long short-term memory baselines; the GRU obtained the strongest combined accuracy and weighted F1 among those models. Mean inference latency on the experimental workstation was 76 microseconds per flow for the classifier alone. The results support the combination of GRU temporal modelling and SHAP explanation for IoT intrusion analysis, while also documenting the hardware, sequence construction, class-wise errors and explanation cost that a deployment study must consider.