Lightweight Transformer-Driven IDS for IoT Networks: Enhancing Transparency with LIME and SHAP

Abstract

The rapid proliferation of Internet of Things (IoT) devices has expanded the attack surface of modern networks, exposing resource-constrained endpoints to a wide range of intrusions including denial-of-service, botnet, spoofing, and reconnaissance attacks. Deep learning-based Intrusion Detection Systems (IDS) have demonstrated strong detection accuracy, but conventional transformer architectures are typically too computationally expensive for deployment on edge and IoT-class hardware, and their internal decision processes remain largely opaque. This paper proposes a lightweight transformer-driven IDS designed specifically for IoT network traffic classification, combining a compact multi-head self-attention encoder with depthwise-separable projections, parameter sharing, and quantization-aware training to substantially reduce model size and inference latency while preserving detection performance. To address the interpretability gap inherent in transformer-based classifiers, the framework integrates two complementary post-hoc explainability techniques, Local Interpretable Model-agnostic Explanations (LIME) and SHapley Additive exPlanations (SHAP), enabling both local, instance-level justification and global, feature-importance-based transparency. Experiments conducted on benchmark IoT intrusion datasets show that the proposed model achieves detection accuracy and F1-scores competitive with heavier baseline transformers and recurrent architectures, while reducing parameter count and inference time considerably, making it suitable for near-real-time deployment on gateway-class and embedded devices. The explainability analysis further demonstrates that the model's attention and decision behaviour align with domain-relevant traffic features, improving analyst trust and supporting regulatory and forensic accountability requirements. The paper concludes by discussing deployment considerations, limitations of post-hoc explanation fidelity, and directions for future work in trustworthy, resource-aware IoT security.