Explainable Machine Learning for Real-Time Cyber Threat Detection: An Intelligent Framework for Adaptive Information Security

Abstract

The cyber threats in IoT environments are constantly changing and need accurate, interpretable, efficient and adaptive intrusion detection. This research suggests an explainable machine-learning framework with the CICIoT2023 dataset. Logistic Regression, Decision Tree, Random Forest, XGBoost, and Explainable Boosting Machine were tested for their ability to perform binary and multiclass classification, their interpretability with SHAP, computational efficiency, and temporal adaptation. Overall, XGBoost outperformed all other models, with a binary F1-score of 0.994, a macro-F1 score of 0.975 for multiclass classification, a mean inference latency of 0.089ms per flow, and a throughput of 11,236 flows/s. When evaluating the robustness of the models, adaptive updating was found to gain by 0.069 in macro-F1 over the last evaluation window under the TDS condition. The influential network traffic characteristics of transparent prediction were identified using SHAP analysis. In summary, the framework combines a variety of predictive accuracy, explainability, near real-time efficiency, and temporal adaptability into a single approach for intelligent IoT security monitoring.