Explainable and Adaptive Intrusion Detection in Digital Twin Environments

Abstract

This paper presents an Intrusion Detection System (IDS) grounded in Explainable Artificial Intelligence (XAI) to enhance transparency, reliability, and user trust in IoT security. To make detection decisions interpretable and accountable, the system employs ensemble machine learning for real-time anomaly detection and integrates two complementary explainability methods: SHapley Additive exPlanations (SHAP), and Local Interpretable Model-agnostic Explanations (LIME). A Digital Twin (DT) module continuously mirrors device behaviour, supporting predictive threat analysis and early anomaly identification by detecting deviations from expected operational baselines. The framework is evaluated on the TON_IoT benchmark dataset using accuracy, precision, recall, F1-score, ROC-AUC, and the Matthews Correlation Coefficient (MCC). Experimental results demonstrate that Random Forest and XGBoost achieve the highest accuracy of 0.996. In the XAI comparison, SHAP outperforms LIME across all metrics $(\mathbf{F} \mathbf{1} \boldsymbol{=} \mathbf{0. 9 9 5}$, $\mathbf{R O C}-\mathbf{A U C} \boldsymbol{=} \mathbf{0. 9 9 8}$ vs. $\mathbf{0. 9 9 3}$ for LIME), confirming its stronger explanatory and predictive effectiveness. While the current framework focuses on XAIdriven detection and digital twin integration, the architecture is designed to accommodate future extensions, including blockchain with zero-knowledge proof (ZKP) protocols for tamper.