An explainable nature-inspired cyber attack detection system in software-defined IoT applications

The integration of the Internet of Things with Software-Defined Networking offers a flexible approach to managing Software-Defined Internet of Things (SD-IoT) applications. However, this architecture is vulnerable to attacks, which may compromise the user's sensitive data. To mitigate this risk, an Intrusion Detection System (IDS) is employed. The IDS model is developed using Machine Learning (ML) algorithms. However, the effectiveness of the ML-based IDS model depends on the optimal number of features used during training. The conventional approach for selecting the optimum feature subset is through hit-and-trial methods, which is a limitation. Moreover, interpreting IDS predictions on malicious flow detection in SD-IoT applications is challenging. So, in this research study, an explainable, lightweight IDS model based on a nature-inspired algorithm is proposed. Lightweight IDS required minimal features selected using the proposed technique based on the Sheep Flock Optimisation Algorithm and Least Absolute Shrinkage Selection Operator (SFOA-LASSO). LASSO uses the α value to measure the cost function and eliminate the redundant features. Eliminating the traditional method, we used the SFOA to obtain the α value. Further, the selected minimal features are used to build an ML-based IDS model. The proposed IDS model is experimentally evaluated on the SD-IoT dataset, which attains high performance in terms of detection rate and accuracy. To understand the prediction made by the IDS, the Shapley values are calculated and plotted using summary and beeswarm plot. The proposed model also performs well when tested on the CIC-IoT-2023 dataset. The obtained results are compared with recent state-of-the-art studies to show the model's robustness.