Logo image
A human-in-the-loop cross-device intrusion detection framework using machine learning and XAI across IoT devices
 

A human-in-the-loop cross-device intrusion detection framework using machine learning and XAI across IoT devices

Munachi Darlina Edom, Celestine Iwendi, Zainab Adeyemo, Khadijat Usman, Emmanuel Okang Edim Jude Osamor
SISCom 2026 (DME College, Noida, Uttar Pradesh, India, 26/12/2026–28/12/2026)
29/07/2026
 
cross-device security intrusion detection botnet detection machine learning explainable AI human-in-the-loop Internet of Things
The expansion of Internet of Things (IoT) devices has increased the attack surface available to botnet malware and has intensified the need for lightweight, transparent and cross-device intrusion detection. This paper proposes a human-in-the-loop intrusion detection framework that combines classical machine learning with explainable artificial intelligence (XAI) for binary detection of benign and malicious IoT traffic. The framework is evaluated using the N-BaIoT dataset, comprising benign, Mirai and Gafgyt traffic collected from multiple IoT devices. To test cross-device generalisation, Danmini Doorbell and Ecobee Thermostat traffic are used for training, while Philips Baby Monitor traffic is reserved as an unseen-device test set. Logistic Regression, Linear Support Vector Machine (SVM) and Random Forest are compared using accuracy, recall, precision and F1-score. Results show that Linear SVM achieves the best overall balance, reaching 96.3% accuracy, 99.9% recall, 93.2% precision and 96.5% F1-score on the unseen device. XAI-oriented feature importance supports analyst interpretation by identifying behavioural traffic features that contribute most to detection. The proposed framework also incorporates analyst feedback logging for offline validation, model update and redeployment. The findings demonstrate that lightweight ML models, when supported by explainable outputs and human review, can provide an interpretable and scalable foundation for cross-device IoT botnet detection.

(2)

pdf
A Human-in-the-Loop Cross-Device Intrusion Detection Framework Using Machine Learning and XAI Across IoT Devices3.95 MB
Accepted Restricted Access  — This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format, so long as attribution is given to the creator.
url
SISCom 2026
Event page
1
Logo image

Usage details for all content viewed and downloaded in this site are shared with IRUS-UK (Institutional Repository Usage Statistics UK). Cookies are used to remember your decision. Click Accept to accept usage details sharing and the cookies.