1 Introduction

The Internet of Things (IoT) has been largely used in the last decade in many instances from smart city applications to multimedia applications [16, 24, 30]. Various types of sensors deployed in IoT settings yields the generation of massive data that needs to be analyzed. Deep learning based solutions [1, 18, 32] performed well for solving IoT problems such as intrusion detection, and prediction. However, they suffer from two main challenges:

  1. 1.

    Hyper-parameter settings: the deep learning models provide various hyper-parameters that can be tuned such as the number of epochs, the activation function, the loss function, the number of batches, and so on. To achieve good performance of the deep learning models, we need to find the optimal values for the different hyper-parameters. Several strategies based on genetic algorithms have been developed in the literature to optimize the hyperparameters [3, 21, 31]. They transform the possible combinations of the hyperparameter values into the solution space and then intelligently explore the solution space with the goal of finding the best values of the hyperparameters that yield the best accuracy of the deep learning model.

  2. 2.

    Interpretation: Deep learning architectures are black box based models. These black-box models are created by a training algorithm directly from data, which means that humans, including those who develop them, have no idea how the factors are combined to produce the given results. Recently, a new class of artificial intelligence solutions has emerged called eXplainable Artificial Intelligence (XAI) [17, 29, 37]. It enables efficient mapping between input features and model results to make deep learning architectures understandable to industrial users.

This paper presents a new framework for handling IoT challenges. The framework explores different correlations among the features of sensor data, and then applies deep learning to learn both prediction, and intrusion detection tasks (the most challenging problems in IoT applications). In addition, XAI is used for better understanding the contribution of each feature in both the prediction, and the detection output. The main contributions of the presented work can be summarized as follows:

  1. 1.

    We propose an adapted Gamian angular strategy to convert the time series collected by the different sensors into visual features that can then be easily represented by a series of images. This allows us to adopt the promising VGG16 architecture to learn the various correlations of sensor data from a set of images.

  2. 2.

    We introduce XAI for IoT applications by analyzing the impact of input values on the output, understanding the different weights of the deep learning model used in the learning process, and calculating the contribution of each feature to the model output. This is done by studying the shape value and learning the deep architecture hyperparameters using the genetic algorithm.

  3. 3.

    We perform intensive experiments on two IoT collections for solving both prediction, and detection problems. According to a series of experiments, the designed method outperforms the baseline algorithms in both runtime and accuracy.

The following is the structure of the rest of the paper. An overview of the most commonly used intrusion detection and prediction methods are studied in Sect. 2. Our approach is described in detail in Sect. 3. Section 4 contains the performance evaluation. The paper is concluded in Sect. 5.

2 Related work

Intrusion detection is one of the challenging problems in IoT settings [15, 22]. Chaabouni et al. [6] study the existing solutions for intrusion detection from IoT data. It suggested an architecture of IoT system composed of perception, network, and application layers. It also surveys both traditional and deep learning works for intrusion detection. Wu et al. [38] deal with heterogeneity issue in IoT, and develop a federated learning based framework in cloud-edge system. The global model is trained by aggregating the local models. Alsaedi et al. [2] introduced a new dataset collection for both industrial internet of things for evaluating intrusion detection systems. It provides different anomalous events for various industrial platforms. The authors also evaluated the well-known machine and deep learning algorithms such as random forest [7], support vector machine [23], and long-short term memory [25] by selecting different views of the proposed dataset. Khraisat et al. [20] proposed a taxonomy of different intrusion detection systems applied on IoT environments. It considers algorithms based on deployment strategy whether the deployment is decentralized, distributed or hybrid. It also considers algorithms with different validation strategy, whether the validation is done by simulation, theoretical, or empirical. It groups the intrusion detection algorithms on supervised and unsupervised models, reinforcement based solutions, and deep learning based solutions. Ullah et al. [36] created a convolution neural network for detecting anomalies in IoT traffic data. The solution is able to identify outliers from 1D, 2D, and also 3D data. Transfer learning is also integrated by using a pre-trained convolution neural network based model for multi-classification problem

Prediction from the IoT data is also a challenging problem in recent decades [10, 42]. Dami et al. [9] predicted the arterial events captured in several months from IoT devices. The authors used the long short term memory with the deep belief network to learn the medical features. The data were periodically collected from wearable heart rate monitoring sensors, and stored as time series where the values are separated by 5 min timestamps. Xu et al. [39] developed prediction model for vehicular data deployed in IoT settings. The Elman neural network with the improved grey wolf optimization is investigated to ensure better solution exploration. The grey wolf optimization is integrated to derive the optimal parameters of the deep learning network used in the prediction process. Sharma et al. [34] predict the situation of COVID disease in Saudi Arabia from data captured by IoT devices. The novel system consists of the study of the IoT variation and the different kinds of symptoms for real COVID cases. Bhat et al. [5] studied the correlation between indoor and the outdoor sensors to predict the Asthma risk from IoT sensor data. The convolutional neural network is trained to learn the matching among both the indoor observation, the outdoor observation, and the prediction values.

However, the above algorithms ignore interpretation of the results and only focus on the model output. This reduces the deployment of such solutions in IoT settings. This paper explores and studies the XAI in both intrusion detection and prediction on IoT devices. The next section presents the new architecture and details about its main components.

3 XD-IoT-based framework

3.1 Principle

Fig. 1
figure 1

Developed XDIoT Framework

Full size image

This section presents our XD-IoT (eXplainable Deep learning for Internet of Things) framework. The purpose is to first solve IoT problems using deep learning technologies and then to understand in detail of the various components that contribute greatly to IoT outputs. Both deep learning and XAI technologies are used to determine which features are involved in IoT outputs. As explained in Fig. 1, the process begins by collecting data from various IoT sensors. The extracted data is then converted into images using the Gramian angular field. Deep learning, specifically VGG16, is applied to the images created to solve IoT problems such as intrusion detection and flow prediction. Since VGG16 contains a large number of hyperparameters to be optimized, the genetic algorithm is used to find the best parameters of the VGG16 model. Explainability is introduced throughout the process by calculating the importance of each input function to the final output. In the remaining of this section, we show how to use all these concepts in the XD-IoT framework.

  1. 1.

    Gamian angular field: It is a strategy highly used to convert time series data to the set of images in a non-Cartesian system [19]. The sensor data can be viewed as a set of time series, where the time is set to the sensor acquisition period. The sensor is explored one by one and transformed to the images by considering the acquisition period as the pixel coordinates, and the sensor value as pixel value.

  2. 2.

    Deep learning: Our deep learning approach uses the images derived in the previous step, and learns the set of features. To learn the collection of IoT features, we employed VGG16. It is a well-known deep learning architectures highly used in many applications [8, 35, 41]. In order to extract the visual features from the generated images depending on the location of reference, VGG16 uses convolutional layers. Filters of window sizes 3, 5, and 7 are applied in parallel to input features in our network. Feature maps of three convolutional blocks are combined and fed successively to the 1024 and 256 neurons in the hidden Fully Connected (FC) layer. The softmax layer receives the output of the FC layer. Overfitting is countered by using dropout in both FC layers.

  3. 3.

    XAI: eXplainable AI (XAI) is introduced for IoT by analyzing the impact of the input values in the output and understanding the different weights of the deep learning models used in the learning process as:

    1. (a)

      Variable Explanation: The input IoT variables are analyzed by extracting visual features of the users. Correlation between the extracted features from CNN, and the features trained by Word2VEc is determined. The obtained correlation is transformed to the matrix, where it is fed it into the layers. The Shapely value is also applied on extracted features to compute the importance of each feature in the output [27].

    2. (b)

      Hyper-parameters-optimization: The network generated requires high number of parameters to be fixed, such as the number of epochs, the learning rate, the activation functions of each layers, and the dropout rate. Therefore, an optimization strategy to set these parameters is needed. The genetic algorithm [12] is successfully applied for the hyper-parameter optimization in solving real world problems [13, 26]. Therefore, we adopt genetic algorithm in finding the optimal parameters of the learning architecture. The set of population is initialized, where each individual is represented by the set of values of each parameter of the learning architecture. Afterwards, the crossover, the mutation, and the selection operators are applied on the current population in order to generate more relevant individuals. The evaluation of each individual is determined using the fitness function. It calculates the accuracy of the generated results. This depends on the particular IoT problem. For example, if the problem is intrusion detection, the fitness function gives the number of intrusions correctly detected by the proposed system. This process is applied for a maximum number of generations iteratively until the termination criteria is achieved.

Algorithm 1 presents the pseudo-code of the developed XDIoT algorithm. The process starts by transforming the sensor data into an image database (lines 4–11). We scan all sensor data, for each value in the given sensor, we associate its value to 1, in its corresponding image. A deep learning model is designed by defining the convolution and max pooling operators. Afterwards, the genetic algorithm is applied to optimize the hyper-parameters of the deep learning model by performing the training phase on the transferred images. These two steps are then executed (lines 13-15). The prediction phase is then launched on the trained model in order to retrieve the IoT outputs (line 16), which highly depends on the problem. For instance, if we aim at solving the intrusion detection, the output will be the set abnormal behaviours retrieved from the IoT sensors. The XAI technology is finally performed to understand the mapping between the IoT features and the derived outputs (line 17). The output of the algorithm is the set of outputs O with their explanation \(O_{XAI}\), which represent the contribution value of each input in the output (line 18).

figure e

4 Performance evaluation

4.1 Experimental environment

Extensive experiments have been carried out to evaluate the performance of the proposed approach using benchmark IoT collections targeting two use cases flow prediction, and intrusion detection. All algorithms have been implemented in Python 3.7 using Keras library for deep learning models. We also implement XAI library to visualize XAI output. The implemented library is based on Bioinfokit.Footnote 1 Both computational time and accuracy are calculated and evaluated in the experiments. The runtime is measured in seconds, and the accuracy is determined by prediction rate (PR) and intrusion detection rate (IR) measures, which are respectively defined as:

$$\begin{aligned} PR=\frac{CorrectedPredicted(\{S_{i} \in {S}_{test}\})}{|S_{test}|} \end{aligned}$$
(1)

and,

$$\begin{aligned} IR=\frac{Detected(\{S_{i} \in {S}_{test}\})}{|S_{test}|}, \end{aligned}$$
(2)

where \(CorrectPredicted(\{S_{i} \in {S}_{test}\})\) is the number of corrected predicted sensor data in the testing sensors, and \(Detected(\{S_{i} \in {S}_{test}\})\) is the number of corrected detected anomaly sensor data in the testing sensors.

Two IoT collections are used in the experiments as follows:

  1. 1.

    IPFlow [33]: It contains 87 features for flow generated by IoT network devices. It is collected over 6 days (April 26, 27, 28 and May 9, 11 and 15) of 2017. A total of 3, 577, 296 time series values are generated.

  2. 2.

    N-BaIoT [28]: This dataset deals with the IoT botnet anomalies. It contains data collected from 9 IoT sensor devices. It represents a set of 7, 062, 606 multivariate time series with 115 features.

The baseline algorithms used in these experiments are RNN-LF [4], and Tripres [40] for flow prediction, and kNN-TF [11], and LOF-TF [14] for intrusion detection, which are all the state-of-the-art models for comparisons.

Fig. 2
figure 2

XD-IoT versus State-of-the-art Flow Prediction Solution: Runtime

Full size image

4.2 Parameters setting

Table 1 Parameter setting of the genetic algorithm
Full size table

Intensive experiments have been carried to tune the best parameters using the genetic algorithm of XD-IoT. We varied the maximum number of iterations IMAX, and population size is set from 10 to 200, and the best values are given in Table 1. In the remaining experiments, the best parameters described in Table 1 are used.

4.3 XD-IoT versus state-of-the-art flow prediction solutions

This experiment compares the performance of XD-IoT with the baseline algorithms for solving the flow prediction problem, RNN-LF and Tripres, using the IPFFlow.

Figure 2 compares the runtime of XD-IoT with the baseline flow prediction algorithms by varying both the number of features and the number of time series values respectively. The results shows the superiority of XD-IoT against Tripres algorithm, and it is very competitive to the RNN-LF. By varying the percentage of features from \(20\) to \(100\%\), the runtime of the proposed solution is less than the two baseline approaches, where a clear superiority against Tripres is observed. For instance, with \(100\%\) of features, the runtime of Tripres exceeds 4 seconds, whereas the runtime of XDP-IoT does not exceed 2 seconds. In addition, XD-HR outperforms RNN-LF when varying the number of features, and RNN-LF outperforms XD-IoT while varying the number of time series values. These results are achieved thanks to the efficient transformation, and deep learning pattern strategies used to predict the flow.

Figure 3 compares the accuracy of XD-IoT with the baseline flow prediction algorithms by varying both the number of features and the number of time series values respectively. By varying the percentage of features and the percentage of time series values from \(20\) to \(100\%\), the prediction rate of the proposed solution is greater than the two baseline approaches. These results are achieved thanks to the use of the genetic algorithm for finding the optimal hyper-parameters of the deep learning architecture.

4.4 XD-IoT vs state-of-the-art intrusion detection solutions

The next experiment aims at evaluating another XD-IoT problem, which is intrusion detection. The baseline algorithms are kNN-TF and LOF-TF for further comparisons.

Fig. 3
figure 3

XD-IoT vs state-of-the-art flow prediction solution: accuracy

Full size image
Fig. 4
figure 4

XD-IoT vs state-of-the-art intrusion detection solution: runtime

Full size image
Fig. 5
figure 5

XD-IoT vs state-of-the-art intrusion detection solution: accuracy

Full size image

Figures 4 and 5 compare both the runtime, and the accuracy of XD-IoT with the baseline intrusion detection algorithms by varying both the number of features and the number of time series values respectively. The results show that the XD-IoT algorithm outperforms both baseline algorithms in terms of runtime and accuracy. These results confirmed again the applicability of the developed XD-IoT for solving IoT applications.

4.5 Explainibility

The last experiment aims to show the interpretation of key results obtained by the XAI process. Both prediction and detection have been performed, and the importance of each input feature is determined. Figures 6 and 7 present the results of the XAI tool developed in the XD-IoT framework. In Fig. 6, our XAI tool is able to visualize the importance of 20 input features collected from the six selected IoT sensors of the IPFlow data, and in Fig. 7, our XAI tool is able to visualize the importance of 50 input features collected from six selected IoT sensors of the N-BaIoT data. These results show that the contribution of the features varied from prediction task to detection task. For instance, 20 important features are identified for the prediction task where 50 features are derived for the detection task. This reveals that the detection task in IoT is much more complicated than the prediction task. Thus, the security issue in IoT is much more challenging than prediction. From these results, we encourage companies and stakeholders to investigate more on security and privacy issues for IoT sensor devices.

Fig. 6
figure 6

XD-IoT: explainability on IPFlow

Full size image
Fig. 7
figure 7

XD-IoT: explainability on N-BaIoT

Full size image

5 Conclusion and future work

In this paper, we propose a novel approach that not only processes IoT data using deep learning models, but also improves the interpretation of the results. Initially, IoT data is collected from various sensors. To efficiently process IoT data, the Gamian angular field is used to transform the signal data into a set of images. The latter are trained by a VGG16 model that incorporates XAI, and hyperparameter optimization. Extensive experiments have been conducted to thoroughly demonstrate the usefulness of our method in two different use cases such as stream prediction and intrusion detection. The experimental results show the efficiency of the proposed approach compared to the baseline approaches in terms of both runtime and accuracy. In the future, we plan to investigate the processing of signals represented by time series data. Therefore, the use of a recurrent neural network with an attention mechanism for processing time series data is crucial. Another perspective of this research is to investigate other genetic algorithms for hyperparameter optimization. Optimizing the shapely value of the whole XAI process is also on our future agenda.