Interpretable Ensemble Learning for Network Traffic Anomaly Detection: A SHAP-based Explainable AI Framework for Embedded Systems Security

TL;DR

This paper introduces an ensemble learning framework combined with SHAP-based explainability for network traffic anomaly detection in embedded systems, improving performance and interpretability.

Contribution

It presents a novel integration of ensemble models with SHAP explanations, tailored for security in embedded systems, demonstrating superior detection accuracy and interpretability.

Findings

Random Forest achieved 90% accuracy and 0.617 AUC.

SHAP analysis identified key features like packet_count_5s and spectral_entropy.

Ensemble methods outperformed individual models in anomaly detection.

Abstract

Network security threats in embedded systems pose significant challenges to critical infrastructure protection. This paper presents a comprehensive framework combining ensemble learning methods with explainable artificial intelligence (XAI) techniques for robust anomaly detection in network traffic. We evaluate multiple machine learning models including Random Forest, Gradient Boosting, Support Vector Machines, and ensemble methods on a real-world network traffic dataset containing 19 features derived from packet-level and frequency domain characteristics. Our experimental results demonstrate that ensemble methods achieve superior performance, with Random Forest attaining 90% accuracy and an AUC of 0.617 on validation data. Furthermore, we employ SHAP (SHapley Additive exPlanations) analysis to provide interpretable insights into model predictions, revealing that packet_count_5s,inter_arrival_time, and spectral_entropy are the most influential features for anomaly detection. The integration of XAI techniques enhances model trustworthiness and facilitates deployment in security-critical embedded systems where interpretability is paramount.