Explainable IoT Intrusion Detection Using Random Forest, SMOTE, and SHAP

Abstract

Class imbalance in Internet of Things (IoT) Intrusion Detection System (IDS) datasets is a major challenge that degrades the detection performance on minority attacks and complicates model interpretability. This study investigates the performance of an IoT IDS based on Random Forest (RF) combined with the Synthetic Minority Over-sampling Technique (SMOTE) and explainable AI analysis using SHapley Additive exPlanations (SHAP) on the public IoTID20 dataset. The research pipeline consists of data preprocessing (cleaning, numerical and categorical feature encoding, normalization), stratified train–test split into 7,000 training and 3,000 test samples, training an RF baseline on the imbalanced training set, applying SMOTE to balance the DoS, Scan, Normal, and MITM ARP Spoofing classes, and training an RF–SMOTE model. The models are compared using accuracy, precision, recall, and F1-score per class as well as macro averages. Afterwards, SHAP is employed to analyse global feature importance for both models. Experimental results show that the RF baseline already achieves very high performance with an accuracy of about 0.99 and a macro F1-score of approximately 0.984, while the RF–SMOTE model maintains the same accuracy with a macro F1-score of around 0.983. SMOTE substantially improves the class distribution in the training set but yields only minor differences in aggregate performance, RF–SMOTE slightly enhances sensitivity for some minority classes, whereas the F1-score for the MITM ARP Spoofing class decreases marginally compared to the baseline. SHAP analysis indicates that flow-related traffic features such as connection duration, packet counts, byte volume, and packet direction ratios are consistently the most influential features in both models. Changes in SHAP values for the RF–SMOTE model highlight an increased relative contribution of features representing rare attack patterns, making explanations for minority classes more prominent. Overall, the proposed RF–SMOTE–SHAP framework delivers a high-performing IoT IDS while providing improved transparency in explaining detection decisions, thereby supporting the development of trustworthy and interpretable IDS solutions for IoT environments.