Interpretable Ensemble Learning for Network Traffic Anomaly Detection: A SHAP-based Explainable AI Framework for Embedded Systems Security

Ensemble methods outperformed individual models for detecting network threats, with Random Forest achieving 90% accuracy in identifying anomalies in embedded system traffic—demonstrating that combining multiple AI approaches yields more reliable security decisions than relying on single models.

The framework prioritizes explainability alongside accuracy, using SHAP analysis to identify which specific features (packet count, timing patterns, and signal characteristics) drive the model's anomaly detection decisions, making it possible for security experts to understand and verify why the system flagged a threat rather than treating it as a "black box."

Interpretability is essential for deploying AI in critical infrastructure, as the paper emphasizes that security-critical embedded systems require transparent decision-making—meaning operators need to trust and comprehend how AI systems protect vital services like power grids or water treatment facilities.

The framework identifies three key indicators of network anomalies: packet arrival patterns within 5-second windows, timing between packets, and spectral entropy (signal complexity), providing security teams with concrete, understandable signals to monitor rather than abstract algorithmic outputs.

This approach balances performance with accountability, addressing a core responsible AI principle: achieving strong security outcomes while maintaining human oversight and the ability to audit why specific network traffic was flagged as suspicious.