AutoSHARC: Feedback Driven Explainable Intrusion Detection with SHAP-Guided Post-Hoc Retraining for QoS Sensitive IoT Networks

Muhammad Saad Farooqui¹, Aizaz Ahmad Khattak², Bakri Hossain Awaji³, Nazik Alturki⁴, Noha Alnazzawi⁵, Muhammad Hanif^6,*, Muhammad Shahbaz Khan²
1 Department of Computer Science, HITEC University, Taxila, 47080, Pakistan
2 School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, EH10 5DT, UK
3 Department of Computer Science, College of Computer Science and Information Systems, Najran University, Najran, 6646, Saudi Arabia
4 Department of Information Systems, College of Computer and Information Sciences, Princess Nourah bint Abdulrahman University, P.O. Box 84428, Riyadh, 11671, Saudi Arabia
5 Computer Science and Engineering Department, Yanbu Industrial College, Royal Commission for Jubail and Yanbu, Yanbu, 46444, Saudi Arabia
6 Department of Informatics, School of Business, Örebro Universitet, Örebro, SE-701 82, Sweden
* Corresponding Author: Muhammad Hanif. Email: email
(This article belongs to the Special Issue: Leveraging AI and ML for QoS Improvement in Intelligent Programmable Networks)

Computer Modeling in Engineering & Sciences https://doi.org/10.32604/cmes.2025.072023

Received 18 August 2025; Accepted 24 October 2025; Published online 25 November 2025

Download PDF

Abstract

Quality of Service (QoS) assurance in programmable IoT and 5G networks is increasingly threatened by cyberattacks such as Distributed Denial of Service (DDoS), spoofing, and botnet intrusions. This paper presents AutoSHARC, a feedback-driven, explainable intrusion detection framework that integrates Boruta and LightGBM–SHAP feature selection with a lightweight CNN–Attention–GRU classifier. AutoSHARC employs a two-stage feature selection pipeline to identify the most informative features from high-dimensional IoT traffic and reduces 46 features to 30 highly informative ones, followed by post-hoc SHAP-guided retraining to refine feature importance, forming a feedback loop where only the most impactful attributes are reused to retrain the model. This iterative refinement reduces computational overhead, accelerates detection latency, and improves transparency. Evaluated on the CIC IoT 2023 dataset, AutoSHARC achieves 98.98% accuracy, 98.9% F1-score, and strong robustness with a Matthews Correlation Coefficient of 0.98 and Cohen’s Kappa of 0.98. The final model contains only 531,272 trainable parameters with a compact 2 MB size, enabling real-time deployment on resource-constrained IoT nodes. By combining explainable AI with iterative feature refinement, AutoSHARC provides scalable and trustworthy intrusion detection while preserving key QoS indicators such as latency, throughput, and reliability.

Keywords

QoS preservation; intelligent programmable networks; intrusion detection; IoT security; feature selection; SHAP explainability; Boruta; LightGBM; explainable deep learning; resource-efficient AI

Downloads
- Full-Text PDF
Citation Tools
- BibTex
- EndNote
- RIS

161

View
27

Download
0

Like

Email Filtering Using Hybrid Feature Selection Model
Adel Hamdan Mohammad , Sami Smadi,...
Machine Learning Techniques for Intrusion Detection Systems in SDN-Recent Advances, Challenges and Future Directions
Gulshan Kumar, Hamed Alqahtani
Dendritic Cell Algorithm with Grouping Genetic Algorithm for Input Signal Generation
Dan Zhang, Yiwen Liang, Hongbin...
A New Hybrid Approach Using GWO and MFO Algorithms to Detect Network Attack
Hasan Dalmaz, Erdal Erdal, Halil...
Improved Supervised and Unsupervised Metaheuristic-Based Approaches to Detect Intrusion in Various Datasets
Ouail Mjahed, Salah El Hadaj,...

AutoSHARC: Feedback Driven Explainable Intrusion Detection with SHAP-Guided Post-Hoc Retraining for QoS Sensitive IoT Networks

Abstract

Keywords

161

27

0

Further Information

Guidelines

Follow Us

Join Us

Contact Us

WhatsApp:

Share Link