Integrating explainable AI with generative models for IoT intrusion detection systems: a systematic review

Abstract

The rapid expansion of the Internet of Things (IoT) has increased cybersecurity exposure and highlighted limitations of intrusion detection systems (IDS), including class imbalance and inadequate representation of minority attack types. Generative models address data limitations, while explainable artificial intelligence (XAI) improves transparency; however, their joint use remains underexplored. We conducted a PRISMA-guided systematic review of studies published from 2014 to 2025 and retrieved from IEEE Xplore, ACM Digital Library, SpringerLink, and ScienceDirect. Eligible studies were categorized as (i) generative augmentation pipelines, (ii) XAI-enhanced IDS models, or (iii) hybrid generative-explainable frameworks. Twenty-one studies were included. GANs and conditional GANs dominated generative IDS research. Approximately 39% of GAN-based and 52% of cGAN-based studies incorporated post-hoc XAI methods such as SHAP and LIME. None of the reviewed InfoGAN-based IoT IDS studies integrated formal XAI mechanisms. Existing research remains fragmented, with gaps in interpretability, cross-dataset robustness, explanation stability, real-time scalability, and deployment readiness. Future work should develop transparent, robust, and efficient generative-XAI IDS frameworks for IoT security.