Abstract

Internet of Things (IoT) environments are increasingly vulnerable to cyberattacks, necessitating effective and explainable intrusion detection solutions. This paper proposes a hybrid and adaptive architecture for explainable intrusion detection in constrained IoT environments. The approach combines workflow mining techniques with security rule-based detection to identify intrusions. It allows to avoid false positives during intrusion detection. Here, explainability also use methods to provide insights into detection decisions. More, the solution is hybrid due to the use of several techniques and also because it allows the detection of intrusions locally or through the Internet. The defined architecture offers advantages such as scalability and flexibility.

References

• Atsa Etoundi Roger, Nkoulou Onanena Georges, Nkondock Mi Bahanag Nicolas, et al. “A Formal Framework for Intrusion Detection within an Information System based on Workflow Audit”. International Journal of Computer Applications, 2013, vol. 81, no 1, p. 1-10.
• Nkondock Mi Bahanag Nicolas, and Atsa Etoundi Roger. ”An overview of Intrusion Detection within an Information System : The Improvment by Process Mining.” Netw. Commun. Technol. 7.1 (2022) : 55-60.
• Nkondock Mi Bahanag Nicolas, Bell Bitjoka Georges, and Emvudu Yves. ”A Framework for Intrusion Detection Based on Workflow Mining.” American Journal of Computer Science and Technology 2.2 (2019) : 27-34.
• Faeiz Alserhani. “Intrusion detection and real-time adaptive security in medical IoT using a cyber-physical system design”. Sensors, 2025, vol. 25, no 15, p. 4720.
• Praveen, S. P., Sharma, K., Parashar, D., Murthy, V. S. N., Sirisha, U., Dewi, D. A. (2025). “Design of an iterative method for adaptive federated intrusion detection for energy-constrained edge-centric 6G IoT cyber-physical systems”. Scientific Reports, 15(1), 41387.
• Li, Yi, Wang, Haitao, and Xu, Guoming. “Federated reinforcement learning–driven multi-task optimization for robust and ethical edge internet of things security”. Scientific Reports, 2026.
• Banbury, C., Zhou, C., Fedorov, I., Matas, R., Thakker, U., Gope, D., ... Whatmough, P. (2021). ”Micronets : Neural network architectures for deploying tinyml applications on commodity microcontrollers”. Proceedings of machine learning and systems, 3, 517-532.
• Ortiz-Garc´es, Iv´an,William Villegas-Ch, and Sergio Luj´an- Mora. ”Autonomous cyber-physical security middleware for IoT : anomaly detection and adaptive response in hybrid environments.” Frontiers in Artificial Intelligence 8 (2025) : 1675132.
• Alauthman, Mohammad, et al. ”Generative Adversarial Networks for Intrusion Detection Systems : A Comprehensive Survey of Applications, Challenges, and Research Directions.” Arabian Journal for Science and Engineering (2026) : 1-25.G. Apruzzese et al., “Real-World IDS Evaluation,” arXiv 2023.
• Ogunseyi, Taiwo Blessing, et al. ”Performance Analysis of Explainable Deep Learning-Based Intrusion Detection Systems for IoT Networks : A Systematic Review.” Sensors 26.2 (2026) : 363.S. Amin et al., “Incremental IDS,” ICASSP 2021.
• Adjewa, Fr´ed´eric, Moez Esseghir, and Le¨ıla Merghem- Boulahia. ”From Edge Transformer to IoT Decisions : Offloaded Embeddings for Lightweight Intrusion Detection.” Sensors 26.2 (2026) : 356.
• Joshi, V. R., Assa-Agyei, K., Al-Hadhrami, T., Qasem, S. N. (2025). “Hybrid AI Intrusion Detection : Balancing Accuracy and Efficiency”. Sensors, 25(24), 7564.
• Upender, Talluri, et al. ”CyberDetect MLP a big data enabled optimized deep learning framework for scalable cyberattack detection in IoT environments.” Scientific Reports 15.1 (2025) : 40865.
• Upender, T., Neelakantappa, M., Rao, C. P., Gera, J., Reddy, V. L., Yamsani, N. (2025). “CyberDetect MLP a big data enabled optimized deep learning framework for scalable cyberattack detection in IoT environments”. Scientific Reports, 15(1), 40865.
• Karthik, M. G., Keerthika, V., Mantena, S. V., Siri, D., Yeluri, L. P., Lella, K. K., Ganesh, B. R. (2026). “Energy-efficient intrusion detection with a protocol-aware transformer–spiking hybrid model”. Scientific Reports.
• Tawfik, M. (2024). “Optimized intrusion detection in IoT and fog computing using ensemble learning and advanced feature selection”. Plos one, 19(8), e0304082.
• Wu, Juan, Shuai Fu, and Mohammad Sarabi. ”Introducing a hybrid intrusion detection method for IoT-cloud environments based on ResNeXt and improved Ebola optimization search algorithm.” Scientific Reports 15.1 (2025) : 37612.
• AR, S., Katiravan, J. (2025). Enhancing anomaly detection and prevention in Internet of Things (IoT) using deep neural networks and blockchain based cyber security. Scientific Reports, 15(1), 22369.
• Talukder, M. A., Khalid, M., Sultana, N. (2025). A hybrid machine learning model for intrusion detection in wireless sensor networks leveraging data balancing and dimensionality reduction. Scientific reports, 15(1), 4617.
• Van der Aalst, W. M., Van Dongen, B. F., Herbst, J., Maruster, L., Schimm, G., Weijters, A. J. (2003). “Workflow mining : A survey of issues and approaches. Data knowledge engineering”, 47(2), 237-267.