An Interpretable Intrusion Detection Approach for IoT Using Graph Attention Networks and Transformer Models with Balanced Learning

Intrusion Detection Systems (IDSs) in Internet of Things (IoT) environments face persistent challenges, including class imbalance in network traffic data and the limited interpretability of black-box machine learning models. This paper proposes a novel, interpretable framework that effectively addresses both concerns. We introduce a Diffusion Model-based Synthetic Data Generator (DM-SDG) coupled with Prototype-Based Undersampling (PBUS) to mitigate class imbalance issues without compromising data integrity. For enhanced feature selection and dimensionality reduction, a dual-stage feature refinement strategy is employed using Self-Supervised Feature Filtering (SSFF) and SHAP-Guided Recursive Pruning (SGRP). Our classification stage incorporates Graph Attention Networks (GATs) and Transformer-based Intrusion Detection Systems (T-IDS), which provide improved context-awareness and sequence modeling in dynamic IoT environments. To enhance transparency and model trustworthiness, we integrate three explainability mechanisms: Counterfactual Explanations (CE), SHAP Interaction Values, and Explainable Concept Activation Vectors (ECAVs), enabling both global and local interpretation of detection decisions. The proposed solution is evaluated on benchmark datasets including CICIDS2018, CIC-ToN-IoT, and NF-UNSW-NB15-v2. Experimental results demonstrate accuracy improvements ranging from 0.5% to 2.4%, along with consistent F1-score and MCC gains of 1.5-3.5% over leading baselines such as CTGAN-ENN. Our framework achieves a balanced trade-off between detection accuracy, computational efficiency, and explainability, making it highly suitable for deployment in real-time IoT security infrastructures.