ShaTS: A Shapley-based Explainability Method for Time Series Artificial Intelligence Models applied to Anomaly Detection in Industrial Internet of Things

TL;DR

ShaTS is a novel explainability method for time series AI models in industrial IoT, leveraging Shapley values with temporal feature grouping to improve anomaly detection explanations in real-time settings.

Contribution

Introduces ShaTS, a model-agnostic, Shapley-based explainability approach that preserves temporal dependencies for more accurate and actionable time series model explanations.

Findings

ShaTS accurately identifies critical time instants and affected sensors.

ShaTS outperforms SHAP in explainability and resource efficiency.

Demonstrated effectiveness on SWaT industrial dataset.

Abstract

Industrial Internet of Things environments increasingly rely on advanced Anomaly Detection and explanation techniques to rapidly detect and mitigate cyberincidents, thereby ensuring operational safety. The sequential nature of data collected from these environments has enabled improvements in Anomaly Detection using Machine Learning and Deep Learning models by processing time windows rather than treating the data as tabular. However, conventional explanation methods often neglect this temporal structure, leading to imprecise or less actionable explanations. This work presents ShaTS (Shapley values for Time Series models), which is a model-agnostic explainable Artificial Intelligence method designed to enhance the precision of Shapley value explanations for time series models. ShaTS addresses the shortcomings of traditional approaches by incorporating an a priori feature grouping strategy that preserves temporal dependencies and produces both coherent and actionable insights. Experiments conducted on the SWaT dataset demonstrate that ShaTS accurately identifies critical time instants, precisely pinpoints the sensors, actuators, and processes affected by anomalies, and outperforms SHAP in terms of both explainability and resource efficiency, fulfilling the real-time requirements of industrial environments.