Explainable AI-Driven Threat Detection and Response for Industrial IoT

Khandan, Shokooh, Beyazgul, Deniz, Jogunola, Olamide ORCID: https://orcid.org/0000-0002-2701-9524, Tsado, Yakubu and Dargahi, Tooska ORCID: https://orcid.org/0000-0002-0908-6483 (2025) Explainable AI-Driven Threat Detection and Response for Industrial IoT. In: 2025 IEEE Conference on Communications and Network Security (CNS). Presented at 10th IEEE International Workshop on Cyber-Physical Systems Security (CPS-Sec 2025), 8 - 11 September 2025, Avignon, France.

Preview

Accepted Version Available under License Creative Commons Attribution. Download (1MB) | Preview

Abstract

The growing complexity and volume of cyber attacks to Cyber-Physical Systems (CPS) and Industrial Internet of Things (IIoT) have outpaced traditional detection methods, requiring more intelligent and explainable security solutions. While Artificial Intelligence (AI)-based anomaly detection solutions have been proposed in the literature, they either focus on a single type of attack, or their decisions are restricted based on a single dataset, or they lack transparency. To address these challenges, this paper presents an explainable attack detection framework for IIoT, combining advanced machine learning (ML) models and AI-driven interpretability. The framework employs midlevel and late data fusion techniques on two IIoT datasets, using Autoencoders (AE) and Manifold Alignment (MA) techniques to generate a unified feature space. A Random Forest (RF) classifier is trained on the fused dataset to detect four attack types, achieving a 97% accuracy. The model’s decision-making is made transparent through Explainable AI (XAI) tools, providing both global and local interpretability. Furthermore, a Large Language Model (LLM)-powered AI assistant is developed to provide automated, context-aware mitigation strategies based on MITRE D3FEND framework. This integrated approach enhances the detection, interpretability, and response to threats in IIoT environments, promoting greater trust and operational resilience.