Experimental Evaluation of Attention-Based Explainable AI Models for Detecting Zero-Day Threats in (IoT) Systems

Abstract

The paper proposes to evaluate attention-based explainable artificial intelligence (XAI) models for their potential to detect zero-day attacks on Internet of Things (IoT) networks. The evaluation will be done by comparing the performance of attention-based XAI models with other baseline models and post-hoc XAI models, considering their trustworthiness as well as their performance. We use a suite of publicly accessible and proprietary IoT intrusion datasets that vary in terms of the underlying protocol, devices, and intrusion types used in the attack scenarios. The study compares attention-based deep models, including sequence- and graph-oriented models, against non-attention-based neural and tree models as baselines. Evaluation criteria are detection performance, faithfulness and stability of the explanations, robustness to domain shift, noise, and adversarial attacks, as well as computational efficiency relevant to edge computing scenarios. In all scenarios, attention-based models achieve superior zero-day detection rates and overall F1-scores compared to the non-attention models, while maintaining competitive latency and resource utilization for edge devices. Explainability of the attention-derived explanations has been shown to be more faithful and stable compared to the post-hoc XAI methods, and they also have better graceful degradation characteristics when faced with domain shifts and adversarial attacks. Attention-based Explainable Intrusion Detection System (IDS) models have promising characteristics of high accuracy, robustness, and interpretability for zero-day threat detection in IoT environments.