The rise in intrusions on network and IoT systems has led to the development of artificial intelligence (AI) methodologies in intrusion detection systems (IDSs). However, traditional AI or machine learning (ML) methods can compromise accuracy due to the vast, diverse, and dynamic nature of the data generated. Moreover, many of these methods lack transparency, making it challenging for security professionals to make predictions. To address these challenges, this paper presents a novel IDS architecture that uses deep learning (DL)-based methodology along with eXplainable AI (XAI) techniques to create explainable models in network intrusion detection systems, empowering security analysts to use these models effectively. DL models are needed to train enormous amounts of data and produce promising results. Three different DL models, i.e., customized 1-D convolutional neural networks (1-D CNNs), deep neural networks (DNNs), and pre-trained model TabNet, are proposed. The experiments are performed on seven different datasets of TON_IOT. The CNN model for the network dataset achieves an impressive accuracy of 99.24%. Meanwhile, for the six different IoT datasets, in most of the datasets, the CNN and DNN achieve 100% accuracy, further validating the effectiveness of the proposed models. In all the datasets, the least-performing model is TabNet. Implementing the proposed method in real time requires an explanation of the predictions generated. Thus, the XAI methods are implemented to understand the essential features responsible for predicting the particular class.

Due to domain variability and developing attack tactics, intrusion detection in heterogeneous and dynamic IoT systems is still a crucial challenge. For cross-domain intrusion detection, this paper proposes a novel algorithm, X-FuseRLSTM, a dual-path feature fusion framework that is attention guided and coupled with a residual LSTM architecture. The proposed algorithm is the combination of four major steps: first, feature extraction using deep encoder and sparse transformer; second, feature fusion of the extracted features and reducing the fused features; third, the classification model; and last, explainable artificial intelligence (XAI). The classification model used is a deep neural network and residual long short-term memory (RLSTM). The model effectively incorporates both spatial and temporal correlations in network traffic data, which improves its detection capability. The model predictions are explained using the XAI techniques. Extensive experiments on datasets including TON_IoT Network, NSL-KDD, and CICIoMT 2024 with both 19-class and 6-class variations show that X-FuseRLSTM achieves the highest accuracy of 99.40% on network, 99.72% on NSL-KDD, and 97.66% for 19-class and 98.05% for 6-class on CICIoMT 2024 datasets. The suggested method is appropriate for practical IoT security applications since it provides strong domain generalization and explainability while preserving computational efficiency.

Internet of Things (IoT) networks are becoming more heterogeneous and complex, making intrusion detection difficult, especially for varied attack classes with nonlinear and overlapping traffic patterns. The major challenge is the high volume of data along with high dimensionality, making it difficult to process in the large search space. Thus, this paper provides a solution for this problem by proposing a novel nonlinear exploration and optimization framework with a reinforced adaptation (NEXORA) algorithm that provides the most important selected features from the large space. NEXORA incorporates chaotic initialization, hybrid exploration, dynamic thresholding, adaptive mutation, and random injection to enhance search diversity, balance exploration and exploitation, and decrease premature convergence. Alpha, Beta, and Delta solutions direct the population toward useful feature combinations, while a fitness function evaluates candidate feature subsets. The selected features are classified using Machine Learning and Deep Learning algorithms. In terms of accuracy, experiments on the IoMT-TrafficData and ToN_IoT datasets show that NEXORA with Extra Trees achieves 99.82% and 99.49%, respectively. In addition, Explainable Artificial Intelligence offers global and class-wise explanations, defining the characteristics of network traffic that are linked with various intrusion classes. Results show that NEXORA provides transparent and secure IoT network security across heterogeneous IoT settings and different intrusion behaviors by combining effective nonlinear feature optimization, high-performance classification, and interpretable class-wise analysis.