A novel hybrid TabTransformer–LightGBM framework for explainable intrusion detection in smart farming IoT networks

Smart farming relies on the Internet of Things (IoT) and cloud computing technologies to optimize agricultural productivity, but the heterogeneity of devices and the complexity of generated data create significant cybersecurity challenges. Resource-constrained IoT devices struggle to implement strong defenses, while traditional intrusion detection systems often have difficulty accurately capturing mixed categorical and numerical features, generalizing across diverse farms, or providing interpretable alerts. To address these challenges, this study proposes a hybrid TabTransformer–Light Gradient Boosting Machine (LightGBM) framework with SHapley Additive exPlanations (SHAP)-based explainability, deployed on cloud infrastructure for scalable, near real-time intrusion diagnosis. The TabTransformer efficiently models complex interactions among heterogeneous IoT features without manual feature engineering, while LightGBM provides robust and computationally efficient classification. SHAP explanations enhance transparency, enabling operators to understand and act on alerts. Evaluations on the CIC-IoT 2023 and CIC-IoT-DIAD 2024 datasets demonstrate accuracy above 98%, high recall and precision, low false alarm rates, and rapid inference of approximately 3.5 ms per instance. Ablation studies confirm the critical role of transformer-based feature representation, while cross-dataset and external validation analyses demonstrate robustness under heterogeneous traffic distributions and diverse attack patterns. The proposed framework offers a practical, interpretable, and scalable solution for securing smart farming IoT networks, effectively addressing complex data heterogeneity and operational constraints.