An Optimized Decision Tree-Based Framework for Explainable IoT Anomaly Detection

Explainability is now essential for practical AI security: The paper demonstrates that modern intrusion detection systems must balance three competing demands—accuracy, transparency, and computational efficiency—rather than treating them as trade-offs. This reflects a shift toward responsible AI where "black box" security systems are no longer acceptable.

Decision trees offer a path to transparent AI without sacrificing performance: The optimized decision tree framework achieved 99.91% accuracy while remaining interpretable, challenging the assumption that the most accurate AI models must be difficult to explain. This suggests explainability doesn't require accepting lower performance.

Multiple explanation methods provide more complete transparency: The framework uses both SHAP values (local explanations for individual decisions) and Morris sensitivity analysis (global feature importance), showing that responsible AI benefits from examining model behavior from multiple angles rather than relying on a single explanation method.

Real-time processing on edge devices enables responsible deployment: By reducing computational demands compared to ensemble models, this approach enables AI security systems to run directly on IoT devices rather than sending data to centralized servers, addressing both privacy concerns and practical deployment challenges in resource-constrained environments.

Identifying key predictive features supports human oversight: The finding that "SrcMac" (source MAC address) was the most significant predictor provides security teams with actionable insights they can verify and understand, enabling human experts to validate whether the AI's reasoning aligns with real-world threat patterns.