A Hybrid Explainable AI for DDoS Attacks Detection in Industrial IoT Networks

The Industrial Internet of Things (IIoT) has transformed industrial processes by allowing real-time data monitoring and automation. While IIoT offers many operational advantages, it is still at risk of cyberattacks like Distributed Denial of Service (DDoS) attacks. This paper introduces a novel Hybrid Explainable AI for DDoS Attack Detection (HEAD) system. The HEAD system combines deep learning, feature attribution, and model optimization within IIoT networks. Unlike earlier systems that rely on tree-based or black-box models without post-training optimization, the HEAD system introduces three main innovations. Firstly, it applies a combined explanation-based feature selection approach using SHAP and LIME to identify both global and local feature importance. The geometric mean of the normalized SHAP and LIME values is used to rank and select the most informative features. Secondly, the HEAD system uses a feedforward deep neural network trained on the selected features to learn important traffic patterns. It maintains high detection accuracy while keeping the model simple and efficient. This replaces traditional ML models with a more compact and flexible architecture. Thirdly, the system applies SHAP GradientExplainer to the trained model to identify neurons in the first hidden layer that are influenced by the input features. These neurons are pruned to create a lightweight version of the model that reduces computation without compromising accuracy. Evaluation on the HL-IoT, ToNIoT, and Edge-IIoTSet datasets shows that the HEAD system attains over 94% accuracy and enhances model efficiency through SHAP-guided pruning. To support real-world deployment the HEAD system provides an interactive interface that shows SHAP visualizations and training results. This helps network administrators monitor predictions and improve detection policies. This design ensures that HEAD is not only accurate but also transparent and suitable for deployment in real IIoT networks.