HEXADWSN: Explainable Ensemble Framework for Robust and Energy-Efficient Anomaly Detection in WSNs

Abstract

Wireless Sensor Networks (WSNs) have a decisive share in various monitoring and control systems. However, their distributed and resource-constrained nature makes them vulnerable to anomalies caused by factors such as environmental noise, sensor faults, and cyber intrusions. In this paper, HEXADWSN, a hybrid ensemble learning-based explainable anomaly detection framework for anomaly detection to improve reliability and interpretability in WSNs, has been proposed. The proposed framework integrates an ensemble learning approach using Autoencoders, Isolation Forests, and One-Class SVMs to achieve robust detection of time-series-based irregularities in the Intel Lab dataset. The framework uses stack and vote ensemble learning. The stack ensemble achieved the highest overall performance, indicating strong effectiveness in detecting varied anomaly patterns. The voting ensemble demonstrated moderate results and offered a balance between detection rate and computation, whereas LSTM, which is efficient at capturing temporal dependencies, exhibited a relatively low performance in the processed dataset. SHAP, LIME, and Permutation Feature Importance techniques are employed for model explainability. These techniques offer insights into feature relevance and anomalies at global and local levels. The framework also measures the mean energy consumption for anomalous and normal data. The interpretability results identified that temperature, humidity, and voltage are the most influential features. HEXADWSN establishes a scalable and explainable foundation for anomaly detection in WSNs, striking a balance between accuracy, interpretability, and energy management insights.

1. Introduction

Wireless Sensor Networks (WSNs) consist of distributed SNs deployed in an Area of Interest (AoI) to collect and communicate environmental parameters such as humidity, light, temperature, pressure, and voltage [1]. WSNs have become essential in numerous applications such as environmental monitoring, critical infrastructure surveillance, smart agriculture, health monitoring, and industrial automation [2]. Despite their transformative potential, WSNs are prone to various types of anomalies due to their resource-constrained configuration and other factors such as faulty sensor nodes (SNs), environmental instabilities, energy depletion, adversarial attacks, or communication or detection failures [3]. These anomalies, if undetected or misinterpreted, can adversely impact the reliability, energy efficiency, and security of the application [4].

Various anomaly detection techniques (ADTs) have been explored in the literature. Few of them have used traditional statistical and rule-based anomaly detection approaches. However, they often struggle to adapt to the dynamic and high-dimensional nature of sensed data, exhibiting high false-alarm rates and poor specificity in real-world deployments [5]. In response, machine learning (ML)- and deep learning (DL)-based ADTs have gained attention in recent years. Their ability to determine complex patterns and facilitate the unsupervised identification of anomalous behaviour without the need for extensive domain heuristics or labels [6]. Techniques such as Autoencoder (AE), Isolation Forest (IF), One-Class Support Vector Machine (OCSVM), and ensemble models have demonstrated notable improvements in accuracy and adaptability. However, these models often function as “black boxes”, providing less or no transparency and obstructive actionable analysis.

Explainable Artificial Intelligence (XAI) offers a promising pathway to interpret, trust, and manage the outputs of complex algorithms by providing explanations for predictions. XAI also helps in identifying biases and attributing the impact of each feature on the present result [7]. XAI techniques are categorised as white box models and post hoc explanation methods. White box models are inherently interpretable, while the latter use various methods to approximate and visualise how predictions are made at the global or local levels [8]. By integrating model-agnostic interpretability tools such as SHAP, LIME, and PFI, it helps to not only flag anomalous patterns but also unravel the underlying contributors and empower network operators with actionable insights to enhance the trustworthiness required for critical WSN applications [9,10].

In this paper, we propose a hybrid explainable energy-aware anomaly detection framework, HEXADWSN, to unify autoencoder-based deep anomaly detection, classic unsupervised models (IF, OCSVM), ensemble learning, and multiple XAI techniques. Beyond state-of-the-art detection, the proposed framework integrates energy estimation and per-instance explainability, making it well-suited for real-time WSN operation as well as post hoc root cause analysis. Through comprehensive experiments on real-world sensor data, we have demonstrated that HEXADWSN delivers robust anomaly identification with both global and local interpretability, supporting the dual goals of reliability and explainability in modern sensor networks. The main contributions of the proposed framework are as follows:

• Preprocessing includes per-mote resampling, temporal feature engineering, adaptive outlier clipping, and normalisation, ensuring clean and context-rich inputs suitable for a variety of unsupervised modelling techniques.
• The HEXADWSN combines AE, IF, and OCSVM into an ensemble framework. The ensemble framework is tested using voting and stacking methods to balance detection accuracy with interpretability and operational relevance.
• The HEXADWSN integrates SHAP, LIME and PFI methods that provide both global and local explanations to enhance transparency and enable actionable insights into the root causes of anomalies.
• SN-level energy consumption and its temporal fluctuations in conjunction with anomaly labels are estimated to enable energy-aware maintenance strategies in real-world networks.
• The framework benchmarks voting and stacking ensembles against an LSTM-based model to demonstrate the trade-offs and complementary strengths in handling the temporal nature of data.

This contribution emphasises novelty in combining explainability, energy-awareness, and hybrid ensemble detection with temporal modelling for improved actionable anomaly detection in WSNs. To analyse the effectiveness of the framework using real data, various parameters have been considered, such as AUC-ROC metrics, F1 score, precision, and recall.

The paper is systematised as follows. Section 2 reviews related work on anomaly detection in WSNs, autoencoders, and explainable AI techniques. Section 3 focuses on the proposed methodology that describes dataset preprocessing steps, feature selection, and model architecture. In Section 4, we have covered the experimental results and performance analysis of the proposed HEXADWSN. Finally, in Section 5 conclusion and future research directions are discussed.

2. Related Work

WSNs comprise distributed SNs that collect and transmit data to a centralised location known as a base station. SNs are resource-constrained devices, which makes them prone to various anomalies caused by various factors such as hardware failures, physical tampering, environmental interference, malicious attacks, or data transmission errors. These anomalies degrade the integrity and reliability of the network. Several statistical and AI-based approaches have been proposed to identify the anomalies. However, DL-based models such as AEs have gained popularity due to their ability to learn complex patterns and detect deviations. Furthermore, various explainability techniques provide insights into model decisions. Existing anomaly detection techniques can be categorised as follows:

• Statistical and Rule-Based Methods: Traditional statistical approaches use rule-based methods such as mean and variance to identify anomalies. Rule-based systems quickly differentiate between normal and compromised traffic, particularly effective against DoS attacks. These methods are simple and computationally efficient yet struggle with dynamic environmental changes and complex dependencies in the data, making them unsuitable for real-time monitoring [11]. Statistical techniques are used to identify correlations in the SD, and Markov models are used to differentiate normal network behaviour. These approaches can detect external and internal threats but do not address the unique challenges posed by the constraints of WSN resources and vulnerability to attacks [12,13].
• ML-Based Methods: ML-based techniques have emerged as effective tools for anomaly detection in WSNs. Various techniques have been used, such as Bayesian classification, Online Locally Weighted Projection Regression, and Support Vector Machines, which have demonstrated high detection rates and low false positive rates, addressing challenges such as hardware failures, physical tampering, software failures, and environmental factors [14]. The ML-based techniques can be categorised into three main categories: supervised, unsupervised, or semi-supervised. Each offers unique advantages for anomaly detection. Supervised learning is effective for anomaly detection, as it can differentiate between normal and anomalous behaviour by learning from a labelled dataset, while the unsupervised technique does not depend upon labelled data for training and can discover hidden patterns to identify unusual behaviour, whereas semi-supervised learning combines supervised and unsupervised learning for anomaly detection [15]. The uses of ML-based techniques in WSNs have shown promising results in various domains; still, various challenges such as handling noisy and unreliable data and adapting to the resource-constrained nature of WSNs remain unaddressed [16].
• Deep Learning Approaches: Several studies have explored DL-based methods for anomaly detection in WSN. These approaches aim to improve security and reliability by identifying potential threats and attacks in the network. A hybrid Deep Generative Model with Isolation Forest (DGM-IF) has been presented that combines DL with the IF algorithm to detect anomalies in an unsupervised manner [17]. The IoT-AnomalyNet model integrates deep learning techniques and achieves high accuracy in real-time anomaly detection for IoT networks [18]. A graph-based deep learning approach has shown potential for anomaly detection in WSNs [19]. A cyber-attack detector method based on deep learning and a combination of CNN and LSTM techniques has demonstrated improved detection accuracy compared to traditional ML-based techniques [20]. These studies highlight the effectiveness of deep learning approaches to address the security challenges faced by WSNs and IoT systems.
• Hybrid ML Models: The SVM-RFNet model combines SVMs, Random Forests, and neural networks, achieves 96% precision in real-time anomaly detection by leveraging feature engineering techniques like PCA [21]. In [22], real-time anomaly detection techniques are presented using Online Adaptive Kalman Filtering (OAKF) to dynamically adjust the parameters to achieve a 95.4% precision while minimizing the false positives and processing time. In [23], a trap-based anomaly detection mechanism is used for deceptive nodes to lure attackers to improve network security and energy efficiency while providing early warning of potential threats.

Autoencoders are a class of neural networks which are trained to encode input data into a compressed representation and then reconstruct it. If an input deviates from normal patterns, the reconstruction error increases, indicating an anomaly in the data. Autoencoders can be classified as sparse autoencoder (SAE), variational autoencoder (VAE), denoising autoencoder (DEA), and LSTM autoencoder (LSTM). The SAE is used for feature learning in high-dimensional SD to enhance detection accuracy; VAE introduces probabilistic modelling to capture complex distributions of normal behaviour, DEA handles noise parameters, whereas LSTMs are used for time-series anomaly detection in sensor networks. Leveraging temporal dependencies, hybrid approaches combine autoencoders with clustering or reinforcement learning for better anomaly classification. These approaches leverage both spatial and temporal features to improve detection accuracy.

Miao Ye et al. [24] proposed a self-supervised learning method that integrates temporal data flow, spatial position, and intermodal correlation features into an AE design. Their approach incorporates graph neural networks and gated recurrent units, achieving an F1 score of 90.6%. The method can be applied to large-scale WSN by first extracting spatial features and then performing clustering operations. Tie Luo & Sai Ganesh Nagarajan [25] introduced a distributed anomaly detection algorithm using autoencoders, which operates on sensors and the IoT cloud, minimising communication overhead and computational load on sensors. Zhaomin Chen et al. [26] employed Convolutional Autoencoders (CAEs) for dimensionality reduction and improved detection accuracy, outperforming other methods in the NSL-KDD dataset.

Despite the effectiveness of using DL and ML models for anomaly detection, they mostly function as black-box models, which limits their usability in critical applications. This motivates the integration of XAI techniques to explain the findings. SHAP and LIME are XAI techniques used to explain the findings whereas PFI is used to compare the effectiveness features across detection models [27]. These XAI techniques enhance trust and model transparency by interpreting the model output.

• SHAP: Based on game theory, SHAP assigns an importance value to each feature, explaining how much it contributes to the model’s prediction. It provides a global feature importance analysis, helping to understand why anomalies occur over time [28].
• LIME: Generates locally interpretable explanations by perturbing individual data instances and approximating the model’s behaviour with a simpler surrogate model. It is useful for understanding specific anomaly cases in WSNs [29].
• PFI: A model-agnostic interpretability technique that quantifies the importance of each feature by measuring how much the model’s predictive performance deteriorates when the feature’s values are randomly shuffled in the validation or test data [30].

Numerous studies have explored the use of SHAP and LIME for the interpretability of the detection model, but their application in AE-based WSN anomaly detection remains limited. This work bridges the gap by integrating SHAP and LIME with AE to provide transparent anomaly detection. Existing studies focus on anomaly detection using ML and DL models, but few incorporate explainability techniques to justify predictions. This work aims to

• Utilise baseline methods AE, IF, and OCSVM to effectively detect anomalies in WSN data;
• Apply stack ensemble and vote ensemble on baseline methods to compare the anomaly detection performance;
• Apply SHAP and LIME to understand the importance of local and global features in anomalies;
• Use PFI to understand the importance of features across models.

By addressing these research gaps, the proposed framework improves reliability and interpretability in anomaly detection, making it more efficient for real-world WSN applications. The individual components such as AE, IF, OCSVM, and XAI methods like SHAP, LIME, and PFI are well-established and have been used in many works [31,32,33,34]. The key contribution of proposed HEXADWSN lies in systematic and tailored integration for robust, energy-efficient anomaly detection. Previous hybrid methods, given in

Table 1. Comparison with previous hybrid anomaly detection models.

ML Model	Integrated XAI
Multiple single and ensemble AI models [35]	Used SHAP, LOCO, ALE, PFI, and ProWeight for explainability
Decision Tree, Random Forest, and Gradient Boosting [36]	Kernel SHAP is used for explainability purposes. The Kernel SHAP is model-agnostic and versatile but is computationally expensive
In [37] CNN, XGBoost, LSTM, and Random Forest are used for initial training of the model and final prediction is performed using a Neural Network meta-model	SHAP and LIME are used for explainability purposes
TinyML, LSTM, and GRU [38]	SHAP and LIME
Autoencoder, GNN, and GRU [39]	The paper does use any explicit XAI. However, the hybrid design focuses on spatial–temporal fusion
CNN, LSTM [40]	No explicit XAI

, often focus on standalone anomaly detection or single-method explainability but fail to address energy utilisation. However, the proposed work addresses energy consumption as a critical factor in WSNs by estimating sensor-level energy use alongside predictive performance, a rarely explored dimension in existing works.

3. Proposed Methodology

The proposed HEXADWSN framework detects anomalies with an interpretable and energy-aware approach in WSNs. This section provides details of the methodology applied to the Intel Lab sensor dataset, emphasising modularity, reproducibility, and scientific rigour. The proposed anomaly detection framework contains unsupervised techniques, ensemble strategies, an energy estimation function, and methods to explain the findings. Three diverse unsupervised techniques, namely, Autoencoder, IF, and OCSVM, are deployed. Ensemble techniques such as stack ensemble and voting ensemble are applied. These ensemble techniques are compared with baseline methods and later compared with LSTM for temporal dependencies. Energy estimation is performed with anomaly detection from the environmental features. SHAP, LIME, and PFI techniques are used for explainability.

3.1. Dataset Description and Preprocessing

In this paper, we have used the Intel lab dataset, also known as the Intel Berkeley Research Lab dataset. Mica2Dot sensors were used to collect timestamped data from the Intel Berkeley lab, once every 31 s [41]. However, in this paper, we have resampled the readings at 10 min intervals to reconcile asynchronous measurements and reduce missingness. Forward and backward filling is performed for the remaining gaps, ensuring a contiguous time series for all nodes. The dataset is split sequentially into training and test sets using a fixed ration of 60% training and 40% test by index slicing. The randomization is fixed globally to ensure reproducible results across operations. The AE is trained with multiple configurations, and the best model is selected based on minimum validation loss. Experiments were performed 5 times with the same seeds.

Table 2. Description of features of dataset [41].

Feature	Description
Date and Time	Timestamp of the data recording yyyy-mm-dd is the format to record the date whereas time is recorded in hh:mm:ss.xxx format.
Epoch	Epoch is the system-generated sequence number from each node.
Mote-ID	Mode-ID is the unique identification number of each SN, ranging from 1 to 54.
Temperature	The temperature recorded by the SNs in degrees Celsius.
Humidity	Humidity is the percentage of humidity detected, ranging from 0 to 100%.
Light	Intensity of light measured by the sensors in Lux.
Voltage	Battery voltage of the sensor node, measured in volts (ranging from 2 to 3 V).

provides the names and descriptions of features, whereas Figure 1 shows the SNs position in the laboratory. The feature space is enriched by temporal context variables like hour and weekday and short-term statistics such as rolling means of temperature and humidity, in addition to the basic features of temperature, humidity, light, and voltage.

To mitigate sensitivity to extreme outliers and sensor faults, robust winsorisation is applied at the 1st and 99th percentiles for each feature, preventing spurious values from dominating the anomaly models. All features are then normalised with MinMax scaling, supporting stable optimisation and comparability across models.

3.2. Anomaly Detection Methods

In this paper, we have selected AE, IF, and OCSVM as baseline models. AE is powerful for capturing complex, nonlinear patterns in high-dimensional data. The IF is also efficient for high-dimensional data and requires less computation to isolate anomalies. OCSVM learns a decision boundary around normal data in feature space, making it robust for cases with only normal samples available. Other unsupervised models lack either interpretability or robustness in complex data, whereas DL alternatives require more computation, which poses challenges in the deployment of SNs. Supervised models require labelled anomaly data, which is not possible in real-world deployment. Their complementary nature boosts ensemble robustness while aligning well with the constraints and characteristics of WSN anomaly detection.

• Autoencoder: A neural network with an hourglass structure is trained to reconstruct normal input. Deviations in reconstruction error are flagged as anomalies. Adaptive thresholds are estimated with a Gaussian mixture fit on residual error distributions and, for robustness, a fixed quantile rule [24]. The loss function used in the autoencoder is the Mean Squared Error, defined using Equation (1).

  $$L={\displaystyle \frac{1}{n}} {{\displaystyle \sum }}_{i=1}^n{\left(X_i-{\widehat{X}}_i\right)}^2$$

  (1)

  where $X_i$ represents the original input and ${\widehat{X}}_i$ is the reconstructed output. A higher reconstruction error suggests a greater deviation from normal patterns, indicating potential anomalies. The training data consists solely of normal sensor readings, ensuring that the autoencoder learns the underlying distribution of non-anomalous data. For anomaly detection, a threshold is established using either a percentile-based method. Any instance with a reconstruction error that exceeds this threshold is classified as an anomaly [42].
• Isolation Forest: IF works on the principle that anomalies are data points that are few and different in the dataset and therefore easy to isolate compared to normal points. IF randomly partition the data using random partitioning without reliance on distributional assumptions. This makes it scalable and computationally inexpensive for WSNs [43].
• One-Class SVM: Kernel-based support vector technique learns the smallest hypersphere or separating hyperplane on normal data. When detecting data falling outside the learned boundary flagged as an anomaly. OCSVM can handle high-dimensional data [44].

These models operate on identical feature sets for fair evaluation and produces complementary anomaly scores. We have compared two ensemble strategies, namely, voting and stacking. In voting ensemble, labels from AE, IF, and OCSVM are aggregated; a sample is flagged as anomalous if at least two models agree, whereas in a stacking ensemble, anomaly scores are concatenated and fed as meta-features to a logistic regression meta-model trained to discriminate consensus outliers. This approach learns optimal model weighting and signal interaction, potentially improving sensitivity and specificity. The latter strategy produces optimal result but requires more computation.

Anomalies in WSNs often arise from patterns evolving over time; to handle such concerns, a sequence-based LSTM autoencoder is used. The LSTM model directly learns from data and reduces modelling effort, potentially discovering complex features that network operators might overlook. The LSTM accepts the input of time-series data using the input layer and encoder layer and uses the first and second LSTM layer to activate the ‘tanh’ function to return the sequence. The decoder layer repeats the vector layer to expand the latent vector to match the input window size. Other models used in the ensemble focus on static aggregated features and lack temporal context. Windowed sequences of normalised features are input to the LSTM, enabling the modelling of temporal dependencies and the detection of outlier patterns missed by other models used in the ensemble.

3.3. Energy Estimation

Each anomaly label is paired with an estimated energy metric calculated from the environmental features and voltage. Aggregation and rolling changes in energy provide operational insight, highlighting resource-critical anomalies and supporting maintenance decision-making. Energy consumption is estimated using a composite metric calculated from SN features that relate to power usage and environmental conditions. Energy consumption estimation E for an SN at time t can be expressed as follows [45]:

$$E_t=\propto \ast L_t+\beta \ast T_t+\gamma \ast H_t$$

(2)

Here, L_t is the light intensity reading, T_t is the temperature reading, H_t is the humidity reading at time t, and ∝, β, γ are weighting coefficients that quantify the relative contribution of each feature to energy consumption [46]. Each coefficient reflects the proportional contribution of the respective feature activity ot the node energy usage. This weighted sum is then normalised, often by the SN voltage V_t, to account for power supply levels, resulting in a normalised energy estimate:

$$E_t^{norm}= {\displaystyle \frac{E_t}{V_t+ ϵ}}$$

(3)

 ϵ is trivial and is used to prevent division by zero [47].

3.4. Explainability and Feature Importance

To aid interpretation and field deployment, the HEXADWSN framework integrates three XAI methods, namely, SHAP, LIME, and PFI. These methods are carefully selected to help network operators understand, validate, and trust model decision. This is vital in critical applications. Each method offers a unique perspective (SHAP and LIME) on local and global interpretability while PFI emphasises on feature importance across models. SHAP is based on cooperative game theory and provides consistent and fair attribution of feature contributions to how each feature influences a specific prediction (local explanation) and overall feature importance (global explanation). SHAP and LIME are both model-agnostic and provides consistent feature attribution regardless of model type. PFI measure the impact of shuffling each feature on overall predictiveness and provides a ranked list of features based on their importance in the model’s performance. Other XAI techniques are powerful but are specific to certain data types and models. Although these are insightful, they are computationally less expensive and straightforward for large and high-dimensional dataset.

• PFI: Measures feature impact for the AE and IF over test data;
• SHAP: Computes feature-level contributions to reconstruction error for individual and global cases, facilitating root-cause diagnosis;
• LIME: Provides instance-specific feature rules for anomalies detected by the AE.

The overall workflow of the methodology is given in Figure 2 and ensures that anomaly detection in WSNs is not only robust and sensitive but also transparent, actionable, and linked to operational priorities.

4. Results and Discussion

The proposed framework HEXADWSN was thoroughly evaluated on the Intel Lab dataset, comparing multiple detection models: AE, IF, OCSVM, a voting ensemble, a stack ensemble, and an LSTM-based AE. First baseline models are compared with stack ensemble and voting ensemble and then with LSTM AE with same dataset. In this paper, we have used a subset of the dataset, as we have considered a time interval of 10 min instead of 31 s as it was in the original dataset. The analysis was not only performed on detection accuracy metrics but also considered energy efficiency, which measures the mean energy consumed by anomalous and normal sensor readings.

Figure 3 displays the correlation matrix among baseline anomaly detection models. The correlation among baseline models shows that each method captures distinct but overlapping sets of anomalies. This diversity is useful for ensemble learning because combining uncorrelated or weakly correlated models can increase detection coverage and robustness. Ensemble learning (stacking or voting) can improve overall accuracy and reduce false positive that might arise if only one model’s output are used.

In

Table 3. Anomaly count and mean energy consumption.

Model	Anomalies	Mean Energy (Anomalous/Normal)
AE	9742	0.1517/0.2280
IF	5945	0.2639/0.2174
OCSVM	9144	0.2270/0.2196
Stack Ensemble	6834	0.1884/0.2227
Vote Ensemble	7657	0.2125/0.2210

baseline and ensemble models are compared on anomaly detection and mean energy requirement for anomalous and normal readings. The stack ensemble performs better than voting and baseline models and reduces the total number of anomalies to 6834 compared to baseline AE’s 9742 and OCSVM’s 9144. It indicates improved filtering of false positives. The mean energy consumption of the stack ensemble for anomalous events, 0.1884, is significantly lower than IF’s 0.2639, which means more efficient use of energy in detecting true anomalies. This reduction is because of meta-learning that minimises redundant activation of high-cost detection components. The vote ensemble is slightly less accurate than the stack ensemble but is computationally more efficient.

Table 4. Performance comparison of anomaly detection models.

Model	F1	Precision	Recall	Accuracy	ROC-AUC
Stack Ensemble	0.6932	0.5981	0.8265	0.9834	0.8924
Vote Ensemble	0.5074	0.4067	0.6744	0.9771	0.8285
LSTM Autoencoder	0.0479	0.0543	0.0429	0.9702	0.5148

compares the performance of ensemble-based models with the LSTM AE model. The results clearly indicate that both ensemble-based approaches significantly outperform the LSTM AE. The voting ensemble demonstrates a balanced performance between detection sensitivity and false alarm reduction. The stack ensemble effectively leverages diverse strengths from multiple various baseline models and delivers the best results.

In Figure 4, the ROC-AUC performance among anomaly detection models is given. The ROC-AUC is a powerful measure for assessing model discrimination. The stack ensemble achieves the highest score, which means the stack ensemble is most effective in distinguishing between normal and anomalous data. The voting ensemble results are lower than those of the stacking ensemble but are still reliable. However, LSTM AE generates significantly lower results.

Figure 5 shows the distribution reconstruction error produced by the AE model for the data. The x-axis represents the reconstruction error values, while the y-axis shows how many samples fall into each error bin. A smaller number of samples have higher reconstruction error, which can be identified by the long spike, and the majority of the data points have very low reconstruction error and are considered normal.

Figure 6 illustrates global SHAP feature importance, and the analysis revealed that the features temperature, temp_mean_3, and hum_mean_3 dominate the AE’s reconstruction influence. These features correspond to physical sensor parameters with strong cross-correlation. The temp_mean_3 represents the 3-point moving average of the temperature reading for a given SN. T_t denotes the temperature value at time t, then for each timestamp t, temp_mean_3 is calculated using Equation (4).

$$temp\_mean\_3_t ={\displaystyle \frac{1}{3}} \left(T_t+T_{t-1}+T_{t-2} \right)$$

(4)

Here, T_t is the current temperature, T_(t−1) is the previous measurement, and T_(t−2) is the measurement of two steps before, and the sum takes the average of the current and two immediately preceding temperature readings. This feature is used to capture the local trends and smooth out short-term fluctuations. Similarly, hum_mean_3 is calculated to capture the short-term trend and smooth fluctuations in humidity. Temperature, 3-point moving average of temperature, and voltage are strongly influential features, whereas humidity is moderate influential, which means variation in environmental moisture affects the model’s performance but less than temperature features.

LIME explanations are given in Figure 7 for individual instances. Each box represents the variation in influence of a specific feature, and the width of each box denotes variability. Features are mentioned on the x-axis, and weights are mentioned on the y-axis. This feature weight distribution helps to validate which condition and feature interval influence the anomaly detector’s decision. Feature such as light, weekday, and hour have very small weights, which indicates their minimal influence on the anomaly detection, whereas hum_mean_3, voltage, and humidity have modest weight. Boxes representing temp_mean_3 and temperature exhibit the strongest weights, confirmed similar behaviour for high-anomaly samples, validating that HEXADWSN’s learned structure reflects interpretable physical relationships.

Figure 8 demonstrates the average LIME feature contribution across all instances. It reveals not only which features matter but which precise value ranges are most influential. Features for light, weekday, and humidity have mean weights near zero, which means these are less critical for model decisions. Features such as hum_mean_3 and voltage have a moderate influence on the decision-making of the model, whereas temp_mean_3 and temperature are important features for identifying non-anomalous states.

The permutation importance comparison for AE and IF is given in Figure 9. The PFI comparison demonstrates which features are universally or model-specifically vital for anomaly detection. Both models frequently attribute high importance to temperature, temp_mean_3, hum_mean_3, voltage, and humidity features. This suggests that these features are consistently crucial for detecting anomalies. The voltage feature has higher importance in IF compared to AE; temperature has slightly higher values for AE, which means it relies on it more heavily than IF. Other features such as light, hour, and weekday are given more weight by IF than AE.

In

Table 5. PFI, SHAP, and LIME values.

Feature	PFI-AE	PFI-IF	SHAP Value (Mean)	LIME Weight (Mean)
temperature	0.036	0.033	0.0058	−0.011
humidity	0.029	0.026	0.0020	−0.009
light	0.019	0.025	0.0008	−0.005
voltage	0.016	0.021	0.0045	−0.007
temp_mean_3	0.024	0.028	0.0060	−0.013
hum_mean_3	0.030	0.030	0.0013	−0.009
hour	0.010	0.016	0.0011	−0.006
weekday	0.011	0.012	0.0007	−0.004

, the PFI shows the mean importance of each feature. Higher values indicate greater impact on model performance if the feature is permuted, while the mean absolute SHAP value indicates how much a feature contributes to the model for a specific output. The average LIME weights for binarized feature conditions in the boxplots quantify their local impact. Larger weights indicate greater influence in predicting anomalies for specific feature intervals. The temperature, humidity, and historical mean features deliver consistent, high explanatory value across models.

Overall, the comparative evaluation highlights the robustness and interpretability advantage of hybrid ensemble frameworks over both rule-based and LSTM-based AE counterparts. The stack ensemble model consistently performs the best across all metrics, whereas the vote ensemble offers a good trade-off between recall and ROC-AUC. The LSTM Autoencoder, while energy-efficient and unsupervised, lags behind in detection accuracy.

5. Conclusions and Future Work

The proposed HEXADWSN framework for anomaly detection in WSNs combines deep reconstruction modelling with baseline unsupervised models, combining them with stack and vote ensembles to achieve robust and accurate identification of anomalous sensor behaviour across the data. Additionally, LSTM-based AE was used to demonstrate the critical value of modelling temporal dependencies for anomalies. The framework extends detection accuracy by incorporating multifaceted XAI techniques to allow transparent and actionable insights into the root causes of anomalies. The experimental evaluation on real Intel Lab data demonstrated that the stack ensemble outperforms the vote ensemble and individual detectors.

The proposed approach bridges the gap between accurate anomaly detection and actionable interpretation, offering insights that can drive self-diagnosis and adaptive control strategies in real deployments. Despite promising results, several avenues remain for extending and enhancing the proposed HEXADWSN framework:

• Adaptive and contextual thresholding: Developing dynamic, context-aware thresholds that adjust in response to environmental changes and sensor drift will improve anomaly discrimination consistency over time.
• Advanced Temporal Modelling: Incorporating more sophisticated temporal architectures, such as Transformers or graph-based sequence models, could further enhance detection of complex spatiotemporal anomaly patterns.
• Edge Deployment Optimisation: Investigating methods for model compression, quantization, or decentralised inference on WSN edge devices will enable real-time, on-node anomaly detection, reducing communication overhead and energy consumption.
• Cross-Dataset Generalisation: Evaluating HEXADWSN in diverse WSN datasets across application domains will validate model robustness and support transfer learning strategies.
• Interactive Explainability: Integrating counterfactual and contrastive explanation methods can provide operators with actionable recommendations, translating anomaly detections into mitigative actions.
• Energy-aware Reinforcement Learning: Investigating reinforcement learning frameworks that optimise anomaly detection accuracy jointly with energy efficiency and network longevity objectives.
• Hybrid Graph-Learning Extensions: Applying graph neural networks and temporal attention models to capture spatial–temporal correlations across motes.
• Causal Explainability Integration: Extending SHAP/LIME with causal models to differentiate between correlated and causative anomaly factors.

Overall, the HEXADWSN framework provides a foundation for interpretable, energy-efficient, and autonomous network health monitoring, positioning it as a practical building block for future self-healing and self-optimising WSN infrastructures. By addressing these challenges, future HEXADWSN iterations can evolve into a holistic platform driving smarter, sustainable, and trustworthy sensing systems in real-world deployments.