{"id":"https://openalex.org/W4415624722","doi":"https://doi.org/10.1109/rtsi64020.2025.11212598","title":"SHAP happens: an Explainable IDS for Industrial IoT Networks","display_name":"SHAP happens: an Explainable IDS for Industrial IoT Networks","publication_year":2025,"publication_date":"2025-08-24","ids":{"openalex":"https://openalex.org/W4415624722","doi":"https://doi.org/10.1109/rtsi64020.2025.11212598"},"language":"en","primary_location":{"id":"doi:10.1109/rtsi64020.2025.11212598","is_oa":false,"landing_page_url":"https://doi.org/10.1109/rtsi64020.2025.11212598","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 9th Forum on Research and Technologies for Society and Industry (RTSI)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://hdl.handle.net/11584/477505","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120162984","display_name":"Pierangelo Loi","orcid":null},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Pierangelo Loi","raw_affiliation_strings":["Università Degli Studi di Cagliari,Cagliari,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Università Degli Studi di Cagliari,Cagliari,Italy","institution_ids":["https://openalex.org/I172446870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033220404","display_name":"Daniele Canavese","orcid":"https://orcid.org/0000-0002-4265-7743"},"institutions":[{"id":"https://openalex.org/I1294671590","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73","country_code":"FR","type":"government","lineage":["https://openalex.org/I1294671590"]},{"id":"https://openalex.org/I134560555","display_name":"Universit\u00e9 Toulouse III - Paul Sabatier","ror":"https://ror.org/02v6kpv12","country_code":"FR","type":"education","lineage":["https://openalex.org/I134560555"]},{"id":"https://openalex.org/I3131550300","display_name":"Universit\u00e9 Toulouse-I-Capitole","ror":"https://ror.org/0443n9e75","country_code":"FR","type":"education","lineage":["https://openalex.org/I3131550300"]},{"id":"https://openalex.org/I4210119061","display_name":"Institut de Recherche en Informatique de Toulouse","ror":"https://ror.org/01rx4qw44","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I205747304","https://openalex.org/I205747304","https://openalex.org/I4210119061","https://openalex.org/I4210152422","https://openalex.org/I4387153255","https://openalex.org/I4405258862","https://openalex.org/I4405259414"]},{"id":"https://openalex.org/I4210152422","display_name":"Universit\u00e9 Toulouse - Jean Jaur\u00e8s","ror":"https://ror.org/04ezk3x31","country_code":"FR","type":"education","lineage":["https://openalex.org/I4210152422"]},{"id":"https://openalex.org/I4210160189","display_name":"Institut Polytechnique de Bordeaux","ror":"https://ror.org/054qv7y42","country_code":"FR","type":"education","lineage":["https://openalex.org/I4210160189"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Daniele Canavese","raw_affiliation_strings":["IRIT, CNRS,Toulouse,France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IRIT, CNRS,Toulouse,France","institution_ids":["https://openalex.org/I4210152422","https://openalex.org/I1294671590","https://openalex.org/I134560555","https://openalex.org/I4210119061","https://openalex.org/I3131550300","https://openalex.org/I4210160189"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064107592","display_name":"Leonardo Regano","orcid":"https://orcid.org/0000-0002-9259-5157"},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Leonardo Regano","raw_affiliation_strings":["Università Degli Studi di Cagliari,Cagliari,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Università Degli Studi di Cagliari,Cagliari,Italy","institution_ids":["https://openalex.org/I172446870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051452548","display_name":"Davide Maiorca","orcid":"https://orcid.org/0000-0003-2640-4663"},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Davide Maiorca","raw_affiliation_strings":["Università Degli Studi di Cagliari,Cagliari,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Università Degli Studi di Cagliari,Cagliari,Italy","institution_ids":["https://openalex.org/I172446870"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5075367917","display_name":"Giorgio Giacinto","orcid":"https://orcid.org/0000-0002-5759-3017"},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Giorgio Giacinto","raw_affiliation_strings":["Università Degli Studi di Cagliari,Cagliari,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Università Degli Studi di Cagliari,Cagliari,Italy","institution_ids":["https://openalex.org/I172446870"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.32486622,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"71","last_page":"76"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.42800000309944153,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.42800000309944153,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.3452000021934509,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.07039999961853027,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/industrial-internet","display_name":"Industrial Internet","score":0.73580002784729},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.6938999891281128},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6829000115394592},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.6093000173568726},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.5192000269889832},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5141000151634216},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.49880000948905945}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7497000098228455},{"id":"https://openalex.org/C202839342","wikidata":"https://www.wikidata.org/wiki/Q60740481","display_name":"Industrial Internet","level":3,"score":0.73580002784729},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.6938999891281128},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6829000115394592},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.6093000173568726},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5192000269889832},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5141000151634216},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5130000114440918},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.49880000948905945},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3921999931335449},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.374099999666214},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.3336000144481659},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.310699999332428},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2987000048160553},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2720000147819519},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.2621000111103058},{"id":"https://openalex.org/C2777986313","wikidata":"https://www.wikidata.org/wiki/Q1661989","display_name":"Industry 4.0","level":2,"score":0.25999999046325684},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.2565000057220459}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/rtsi64020.2025.11212598","is_oa":false,"landing_page_url":"https://doi.org/10.1109/rtsi64020.2025.11212598","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 9th Forum on Research and Technologies for Society and Industry (RTSI)","raw_type":"proceedings-article"},{"id":"pmh:oai:iris.unica.it:11584/477505","is_oa":true,"landing_page_url":"https://hdl.handle.net/11584/477505","pdf_url":null,"source":{"id":"https://openalex.org/S4377196293","display_name":"UNICA IRIS Institutional Research Information System (University of Cagliari)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172446870","host_organization_name":"University of Cagliari","host_organization_lineage":["https://openalex.org/I172446870"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferencePaper"}],"best_oa_location":{"id":"pmh:oai:iris.unica.it:11584/477505","is_oa":true,"landing_page_url":"https://hdl.handle.net/11584/477505","pdf_url":null,"source":{"id":"https://openalex.org/S4377196293","display_name":"UNICA IRIS Institutional Research Information System (University of Cagliari)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172446870","host_organization_name":"University of Cagliari","host_organization_lineage":["https://openalex.org/I172446870"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferencePaper"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W1545142396","https://openalex.org/W2150847526","https://openalex.org/W2171861685","https://openalex.org/W2512144135","https://openalex.org/W2765558264","https://openalex.org/W2767153057","https://openalex.org/W2803414046","https://openalex.org/W2963197901","https://openalex.org/W3017093935","https://openalex.org/W3129974072","https://openalex.org/W3141567114","https://openalex.org/W3187445342","https://openalex.org/W3206894072","https://openalex.org/W4200363262","https://openalex.org/W4205904685","https://openalex.org/W4281609751","https://openalex.org/W4294559022","https://openalex.org/W4295957092","https://openalex.org/W4307373104","https://openalex.org/W4316039105","https://openalex.org/W4327957739","https://openalex.org/W4383709711","https://openalex.org/W4385688168","https://openalex.org/W4396605089","https://openalex.org/W4396816109","https://openalex.org/W4397026497","https://openalex.org/W4400762160","https://openalex.org/W4401011499","https://openalex.org/W4402215615","https://openalex.org/W4403191928","https://openalex.org/W4405660177","https://openalex.org/W4405778752","https://openalex.org/W4407430045","https://openalex.org/W4412685972"],"related_works":[],"abstract_inverted_index":{"Industrial":[0],"Internet":[1],"of":[2,20,32,86,94,131,149],"Things":[3],"(IIoT)":[4],"technologies":[5],"have":[6,35,58],"been":[7],"increasingly":[8],"leveraged":[9],"across":[10],"various":[11],"industry":[12],"sectors,":[13],"due":[14,63],"to":[15,64,67,127],"their":[16,65,92],"benefits":[17],"in":[18,71,91,100],"terms":[19],"automation,":[21],"monitoring,":[22],"and":[23,30,121,176,190],"operational":[24],"efficiency.":[25],"However,":[26],"the":[27,38,139,168],"increased":[28],"connectivity":[29],"heterogeneity":[31],"IIoT":[33],"devices":[34],"also":[36,159],"broadened":[37],"attack":[39],"surface,":[40],"making":[41],"these":[42],"systems":[43],"attractive":[44],"targets":[45],"for":[46,98,117,163],"cyber":[47],"threats.":[48],"In":[49],"this":[50,104],"context,":[51],"machine":[52],"learning\u2013based":[53],"Intrusion":[54],"Detection":[55],"Systems":[56],"(IDS)":[57],"emerged":[59],"as":[60,173],"promising":[61],"solutions":[62],"ability":[66],"detect":[68],"complex":[69],"patterns":[70],"network":[72,150,170],"traffic":[73,119],"without":[74],"relying":[75],"on":[76],"static":[77],"rules":[78],"or":[79],"deep":[80],"packet":[81,177],"inspection.":[82],"A":[83],"key":[84],"limitation":[85],"such":[87,172],"systems,":[88],"however,":[89],"lies":[90],"lack":[93],"interpretability,":[95],"posing":[96],"challenges":[97],"adoption":[99],"safety-critical":[101],"industrial":[102],"settings.In":[103],"work,":[105],"we":[106],"propose":[107],"an":[108],"explainable":[109],"IDS":[110,193],"that":[111,179],"leverages":[112],"a":[113,146],"Random":[114],"Forest":[115],"classifier":[116],"accurate":[118],"classification":[120],"integrates":[122],"SHAP":[123],"(SHapley":[124],"Additive":[125],"Explanations)":[126],"provide":[128],"transparent":[129],"explanations":[130,162],"model":[132],"decisions.":[133],"We":[134],"evaluate":[135],"our":[136],"system":[137],"using":[138],"CIC":[140],"IoT-DIAD":[141],"2024":[142],"dataset,":[143],"which":[144],"includes":[145],"broad":[147],"spectrum":[148],"attacks.":[151],"Our":[152],"approach":[153],"demonstrates":[154],"good":[155],"detection":[156],"performance":[157],"while":[158],"delivering":[160],"intuitive":[161],"each":[164,182],"prediction.":[165],"By":[166],"analyzing":[167],"specific":[169],"features,":[171],"inter-arrival":[174],"times":[175],"sizes,":[178],"most":[180],"influence":[181],"alert,":[183],"security":[184],"analysts":[185],"may":[186],"better":[187],"assess,":[188],"validate,":[189],"act":[191],"upon":[192],"outputs.":[194]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-28T00:00:00"}