GA-optimized deep learning intrusion detection framework with LIME explainability for IoT networks

Abstract

The rapid expansion of the Internet of Things (IoT) has generated complex, high-volume network traffic that traditional signature-based Intrusion Detection Systems (IDS) struggle to analyze effectively. Conventional systems often fail to adapt to evolving attack behaviors and high-dimensional data, resulting in reduced accuracy and explainability. This study presents Genetic Algorithm (GA)-optimized deep learning models, namely GA-GRU and GA-LSTM, for efficient and interpretable intrusion detection in IoT ecosystem. GA was employed for dual optimization, simultaneous feature selection and hyperparameter tuning, to achieve a balance between accuracy, computational efficiency, and interpretability, distinguishing this work from prior GA-based IDS approaches. The models were evaluated using two benchmark datasets, IoT-ToN and UNSW-NB15, selected for their diverse traffic patterns, heterogeneous feature spaces, and complementary representation of IoT and enterprise network behavior. This combination supports the cross-domain generalizability of the proposed framework. Experimental findings show that GA significantly reduced the feature space while improving runtime and memory efficiency. The GA-GRU model achieved an accuracy of 95.8%, outperforming state-of-the-art IDS models. Both GA-optimized architectures recorded high precision, recall, and F1-scores, with low False Positive Rates(FPR), confirming their robustness in real-world detection. Although GA identified different optimal feature subsets for GRU and LSTM, the recurring key features indicate selection stability across architectures. Moreover, LIME-based interpretability analysis provided transparency into model decision-making, enhancing trust and explainability. Overall, the proposed framework delivers a novel, generalizable, and resource-efficient IDS solution tailored for next-generation IoT environments.