Explainable AI for Securing Perception-Layer Sensor Data in IoT Environmental Danger Detection Systems

Abstract

This paper presents an explainable defense framework against perception-layer and Man-in-the-Middle (MitM) attacks in Internet of Things (IoT)-based environmental hazard warning systems. These systems rely on heterogeneous sensors (gas, light, sound, temperature, and humidity) whose integrity is crucial for reliable environmental alerts. Perception-layer attacks such as spoofing, jamming, and data injection can compromise sensor readings, while MitM attacks threaten communication reliability. The proposed approach integrates incremental Dynamic Time Warping (DTW) for time-series anomaly detection with a tree- based ensemble classifier (XGBoost), in addition to Shapley Additive Explanations (SHAP) for interpretability. A comparative evaluation framework jointly considers detection performance and explanation quality through metrics including pre-registering a Casual Ground Truth based on network protocol localized Precision@ K feature overlap metrics (Q), instead of relying on subjective human-expert or global rank correlations to quantitively evaluate the explanation transparency. Experimental simulations using an authentic EdgeIIoT-2022 dataset under 3-fold forward–chaining cross-validation demonstrated high detection accuracy and moderated explainability scores. The results prove the framework’s ability to detect and explain adversarial behaviors in sensor networks, strengthening trust, transparency, and resilience in safety-critical IoT infrastructures.

1. Introduction

In the field of the Internet of things (IoT), a wide range of security vulnerabilities still pose serious risks to systems relying on distributed sensing [1]. These systems often operate autonomously and continuously, processing large volumes of environmental data for real-time decision-making. Understanding the impact of IoT security leaks has become critical, as several incidents demonstrate the potential severity of such vulnerabilities. Examples include (a) the hacked baby monitors in Ohio and Texas [2], (b) the attacks over devices produced by Acoustic Technology Inc. [3], and (c) the Turning Up the Freeze Distributed Denial of Service (DDoS) attack over environmental control systems [4]. IoT security threats are typically categorized into three major layers: (1) perception-layer attacks, such as botnets, node tampering, jamming, or data spoofing; (2) network-layer attacks, including Man-in-the-Middle (MitM), DDoS, perception-layer attacks that compromise sensor integrity, and routing manipulation; and (3) application-layer attacks, such as malware or code injection. Among these, perception-layer attacks [5] are particularly concerned in systems that depend heavily on accurate and trustworthy sensor readings for example for considering environmental awareness or user health.

The growing deployment of IoT-based environmental monitoring systems [6] introduces new challenges in security and reliability. These systems, which integrate gas, light, sound, temperature, and humidity sensors, aim to warn users about potential dangers in a location based on the sensed environmental data. The gathered information is processed by embedded microcontrollers and transmitted via Wi-Fi to backend services responsible for real-time alerting through intelligent assistants such as Alexa. Despite their evident usefulness for public safety and environmental monitoring, these systems can become ineffective or even dangerous when perception-layer attacks in this context can modify sensor readings, inject false data, or manipulate the temporal arrival of packets (Inter-Arrival Time), leading to erroneous environmental interpretations. For instance, a malicious alteration in gas concentration measurements [7] could prevent an alert from being triggered during a gas leak, or an artificial light or sound disturbance could simulate nonexistent environmental hazards. Therefore, the robustness of the perception layer becomes essential for maintaining the reliability of the entire warning infrastructure.

This article focuses on perception-layer security in IoT-based environmental hazard warning systems. Specifically, it explores the MitM attack not only as a network routing threat but as a high-fidelity perception-layer intervention targeting sensor data acquisition and proposes defensive mechanisms based on anomaly detection and time-series analysis. By reinforcing the perception layer, the goal is to ensure that alerts generated by these systems remain accurate, timely, and trustworthy, even in the presence of adversarial interference. Moreover, this article explores MitM attacks in network communication when sensors are communicated through Internet to the environmental system. By utilizing ARP-spoofing at the IoT edge, the attacker can subtly warp the temporal signature of sensor streams. We propose a transparent, feature-driven approach using DTW and (XAI) to provide casual evidence of temporal anomalies which lead to detecting these deviations. Unlike black-box detection methods, our approach derives a transparent causal link between the physical network intervention and the resulting anomaly. This ensures the defensive mechanism is not only accurate but methodologically sounds and explainable to security auditors. We do not claim a new intrusion classifier in general; instead, we contribute a reproducible evaluation design for explainable perception-layer data protection in which the explanation metrics are explicit, auditable and aligned with the top ranked features that human analysts inspect.

2. Related Work

XAI has been previously applied in cybersecurity in the context of deep learning and other artificial intelligence (AI) approaches. Pawlicki et al. [8] reviewed major XAI techniques and their benefits, systematically mapped the field to identify trends, and highlighted future research directions for integrating explainability into AI-driven cybersecurity systems. However, they did not provide an approach that avoided both perception-layer and MitM attacks for ensuring appropriate functioning in environmental systems with different environmental sensors.

2.1. XAI in AI-Driven Cybersecurity Systems

IoT enables the interconnection of heterogeneous devices capable of sensing, processing, and communicating data to provide context-aware services. These systems have evolved to support critical applications such as environmental monitoring, smart homes, healthcare, and industrial safety. In the case of environmental hazard warning systems, the perception layer plays a fundamental role, as it is responsible for acquiring reliable measurements from the physical environment through various sensors, including gas, light, sound, temperature, and humidity sensors. For instance, the study of Kong et al. [9] highlights the potential for model transparency; there remains a critical research gap in applying these techniques to detect temporal distortions at the perception layer. Using characteristic index gases, a dynamic discriminant model achieved high accuracy. Comparative analyses confirmed superior performance, offering valuable insights for efficient fire prevention in mining areas. However, this work did not suggest novel XAI cybersecurity mechanisms for ensuring the proper functioning of these environmental systems. In addition, comprehensive surveys, such as systematics mapped by Rjoub et al. [10], have primary XAI techniques (Shapely Additive explanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), and integrated gradients) and an outlined strategic direction for embedding explainability into autonomous defense systems. Similarly, Capuano et al. [11] provided a structured taxonomy of XAI applications in cybersecurity, emphasizes the need for model-agnostic explanations that can generalize across diverse threat detection scenarios.

Pawlicki et al. [8] further advanced this by mapping future research directions for XAI in deep learning and AI used in cybersecurity, identifying critical gaps in quantitative validation frameworks and the integration of XAI with real-time threat response mechanisms. Even with these conceptual taxonomies, the practical implementation remains limited. A huge part of the existing XAI framework operates as a post hoc diagnostic tool for network packet classification instead of an active component capable of guiding defenses against perception-layer data manipulation and MitM attacks.

Moreover, few studies quantitively leverage XAI alignment (evaluating explanation stability via rank correlation metrics) to validate if the model’s local decision aligns consistently with known physical attack vectors across diverse environmental sensors. Miller et al. [12] mentioned this limitation by arguing that most XAI research relies on instinct instead of the practically grounded theories of human explanation, calling for multi-specialized methods to integrate insights from cognitive psychology and social sciences into XAI future design.

2.2. Perception-Layer Vulnerabilities and Data Integrity Defenses

The perception layer represents the entry point for all environmental data, making it the first target for adversaries seeking to compromise the integrity of the system. The attacks at this layer generally aim to manipulate sensor inputs or weaken their functionality to cause incorrect evaluations of environmental conditions. Common examples may include sensor spoofing, where attackers generate artificial triggers to mislead the system. For example, emitting specific gas concentration to falsify readings; signal jamming, which prevents sensors from accurately transmitting data; and data injection attacks, where faked sensor values are introduced into the communication channel. Kong et al. [9] designed an intelligent early warning system for preventing environmental pollution from coal spontaneous combustion using characterized index gases and a dynamic discriminate model to achieve high accuracy in fire detection. While achieving high classification performance, their architecture neglected defensive cybersecurity mechanisms, leaving the system exposed to malicious injections.

In terms of environmental data collection systems, perception-layer attacks can have severe consequences. For instance, spoofing or tampering with gas sensors could prevent the detection of toxic leaks, while manipulating sound or light sensors might trigger false alarms or conceal actual environmental hazards. These vulnerabilities are particularly critical in safety-critical systems designed to warn people about potential dangers in their surroundings. Nasralla et al. [5] proposed a technique for defending against perception-layer attacks in the context of IoT smart furniture for impaired people. They used Dynamic Time Warping (DTW) comparison for identifying strange daily series compared to the usual daily series as an indicator of a malfunctioning sensor or perception-layer attack. Our current work also uses DTW but adds XAI concepts for making environmental administrators more aware of the reasons behind an attack warning. Moreover, a recent study has started to address this gap by proposing learning-based and data-driven approaches to detect perception-layer anomalies. For example, time-series analysis methods such as DTW and Long Short-Term Memory (LSTM) networks have been applied to identify deviations from normal sensor behavior in smart environments. For instance, Yolaçan and Zaim [13] proposed an LSTM-based Dynamic Compound Weight Mechanism (DCWM) to detect cyberattacks on robotic arms, including replay and subscriber flood attacks. These techniques rely on the temporal correlation and continuity of sensor data to detect inconsistencies that may indicate attacks. In addition, sensor fusion techniques have been explored to cross-validate measurements from multiple sensor types, improving resilience against single-sensor compromise. Nevertheless, Yolaçan and Zaim did not include the application of XAI as the current work does for making environmental systems trustable in the eyes of users.

2.3. Multi-Class IoT Intrusion Detection and Communication Security

Research on IoT security has traditionally focused on network and application layers, where threats such as Man-in the-Middle (MitM) attacks, DDoS, and malware have been extensively analyzed. For instance, Cherian and Varma [14] addressed IoT security challenges, particularly Distributed Denial of Service (DDoS) and MitM attacks, by proposing a Belief-Based Secure Correlation methodology. Integrating IoT with Software-Defined Networking (SDN) and Redstone cryptographic encryption, the framework ensured secure data transmission, dynamic route selection, and effective prevention of DDoS, MitM, and related data attacks. However, the perception layer remains comparatively underexplored, even though it represents the foundation of trust in IoT architectures. Without securing this layer, even the most sophisticated encryption or network defenses become ineffective, as decisions are based on compromised or inaccurate sensor data. The current work provides a joint approach that considers both communication attacks such as MitM and perception-layer attacks in the diversity of IoT sensors in environmental systems. Similarly, Alani et al. [15] and Khedr et al. [16] have advanced MitM detection using the ARP spoofing detection system and muti-classifier ensemble method on the EdgeIIoT-2022 dataset, achieving accuracy exceeding 99.89% with false alarm rates below 0.02%. However, these approaches prioritize network metadata over the underlying time-series telemetry of physical sensors. Concurrently, many studies focus on developing multi-class classification algorithms especially designed for IoT network traffic using benchmark datasets like Edge-IIoT-2022. Ferrage et al. [17] introduced this comprehensive dataset capturing authentic traffic from large-scale IoT testbeds, including protocols such as MQTT, HTTP, and DNS, with fourteen attack categories spanning DoS/DDoS, information gathering, MitM, injection and malware attacks. While these metrics achieved near-perfect metrics (F1-score approaching 0.99 for specific network vectors like MitM), they rarely bridge the gap between network-layer metadata and underlying time-series telemetry of physical sensors.

2.4. Emerging Trends: Large Model Agents in IoT Security

As IoT ecosystems scale into autonomous, decentralized environments, the integration of large model agents (LMAs) and the internet of agents (IoA) have emerged as an active research frontier; recent research provides critical insights into these paradigms:

State-of-the-art cooperation paradigms: Wang et al. [18] comprehensively surveyed the state of the art in large model-based agents, detailing their capacity for multi-agent reasoning, autonomously orchestrating in complex environments, comprehending intent, and their work maps’ ability to cooperate with paradigms including data cooperation, computation cooperation, and knowledge cooperation across cloud-edge-end architecture, showing the potential for LMAs to perform coordinated threat modeling and real-time defense adaptation.

Internet agents (fundamentals and challenges): Wang et al. [19] provided a systematic review of IoA fundamentals, applications and challenges, emphasizing the need for scalable and secure coordination among heterogenous agents; their work identifies key architectural components including capability notification, dynamic discovery, and trust-based task orchestration, which are essential for deploying autonomous defense mechanisms in distributed IoT environments.

Security, Privacy, and Challenges: Wang et al. [20] offered a comprehensive examination of the security and privacy landscape in IoA systems, focusing on four critical aspects (identity authentication threats, cross-agent trust issues, embodied security, and privacy risks); their taxonomy reveals that LMAs introduce unique threat surfaces including prompt injection, hallucination-driven policy failure, and privacy leakages over edge networks (specifically embodied security threats such as sensor spoofing and cross-modal backdoors) which can lead to harmful physical behaviors when agents control IoT infrastructure.

While LMAs offer unparalleled potential for high-level collaboration and future autonomous remediation, their heavy computational footprint limits direct execution on resource-constrained perception-layer microcontrollers. This reinforces the necessity of the proposed framework, which provides lightweight, deterministic, tree-based ensemble models backed by quantitative XAI to ensure edge data before it is ingested by upstream autonomous agents.

2.5. Research Gap Analysis

Despite significant progress across these individual domains, a critical research gap persists at the intersection of temporal feature engineering, multi-class communication security, and quantitative XAI verification; existing frameworks force a trade-off between the mathematical robustness of temporal alignment (for example, DTW) and the systemic visibility offered by explainable model outputs.

Table 1. Comparative analysis for the state of the art (✗: not included, ✓: included).

Study	Perception-Layer Defense	Network/MitM Protection	Temporal Feature Extraction	Multi-Class Security	XAI Core Integration	Quantitative XAI Verification
Kong et al. (2025) [9]	✗	✗	✗	✗	✗	✗
Rjoub et al. (2023) [10]	✗	✗	✗	✗	✓ (Theoretical)	✗
Capuano et al. (2022) [11]	✗	✗	✗	✗	✓ (Theoretical)	✗
Pawlicki et al. (2024) [8]	✗	✗	✗	✗	✓	✓
Miller (2019) [12]	✗	✗	✗	✗	✓	✓
Nasralla et al. (2020) [5]	✓	✗	✓ (DTW)	✗	✗	✗
Yolaçan & Zaim (2025) [13]	✗	✗	✓ (LSTM)	✗	✗	✗
Cherian & Varma (2022) [14]	✗	✓	✗	✓	✗	✗
Alani et al. (2023) [15]	✗	✓	✗	✓	✗	✗
Khedr et al. (2023) [16]	✗	✓	✗	✓	✗	✗
Wang et al. (2025) [18]	✗	✗	✗	✗	✓ (LLM-based)	✗
Proposed Framework	✓	✓	✓ (DTW + Time-Series)	✓	✓ (SHAP)	✓ (localized Q)

shows the capabilities of recent representative state-of-the-art approaches against our proposed multi-layered defense architecture.

3. Proposed Approach

3.1. Overview

This work proposes a technique that aims to defend IoT-based environmental danger warning systems against perception-layer attacks and MitM attacks that compromise sensor readings and lead to unreliable or misleading environmental alerts. It also considers MitM attacks in the connection between sensors and the environmental system as well as the network link to the cloud backend. Since the perception layer is responsible for capturing physical-world data through sensors, it represents the most vulnerable point in the IoT stack. Malicious alterations to this layer can undermine higher-layer trust, making it essential to implement intelligent and interpretable defense mechanisms.

The defense model combines time-series anomaly detection with (XAI) achieves two objectives:

• High Attack Recall: Identify irregular or adversarial behaviors in sensor readings caused by spoofing, jamming, or data injection.
• Transparency and Trust: Provide interpretable explanations for the detected anomalies, ensuring that both developers and end-users understand the rationale behind each detection decision.

This technique is designed for environmental system architectures that include environmental sensors (gas, light, sound, temperature, humidity) connected to a microcontroller for local processing and data transmission to a cloud-based backend. The backend executes the proposed learning-based defense module and triggers alerts through an Alexa-based notification interface when a real environmental hazard is confirmed. Figure 1 shows this architecture of the defense mechanism, in which the normal alert messages (NAMs) include some explanations based on the XAI output.

The proposed framework consists of a serialized four-stage pipeline designed to ingest, process, evaluate and validate streaming network data in real time. The comprehensive workflow transitions systematically from the initial data ingestion to localized model validation with precision@ k feature overlap as illustrated in Figure 2:

• Dynamic stream initialization: Establishes the real-time context by ingesting streaming live network packets and dynamically extracting the vector baselines for the next tasks.
• Incremental DWT time-series extraction: Uses a sliding window protocol configured to a sequence length of 10 packets to compute dynamic temporal costs.
• Multi-objective detection: Passes the computed temporal metrics to ensemble classifier (XGBoost) to execute highly accurate traffic classification coupled with a SHAP explanation layer for instant predictive attribution.
• Localized precision@ k XAI validation: Extracts the top-k SHAP feature importances and cross-references them against the pre-registered expert casual matrix.

3.2. Learning-Based Detection Module

The proposed defense mechanism uses a hybrid learning model that integrates distance metrics (Dynamic Time Warping (DTW) or Euclidean distance) for temporal similarity analysis and tree-based ensemble classifiers (e.g., XGBoost or Random Forest); for attack classification, the model constantly reads incoming network traffic, then it implements a dual-routing strategy:

• Temporal attacks (MitM and similar attacks): Attackers intercept and change network data, which causes a noticeable “rhythm disruption” in how and when packets arrive. These attacks are routed through our sequential feature engineering pipeline (length and timing) to detect the shift.
  We calculate DTW cost by comparing a sliding window of the current 10 income packets against a pre-registered “Normal” reference window.
  This converts the raw network signature into a “Warping Cost” feature that measures the temporal incongruence. Large deviations in DTW distance values indicate temporal inconsistencies.
• Non-temporal attacks (SQL Injection and other attacks): These stealthy attacks do not disrupt network packet schedules or sequence timing; therefore, they bypass the sequential distance calculation and route directly to the multi-dimensional tree structure of the XGBoost engine, which catches them using the standard packed field vector.
• Anomaly Classification: Extracted time-series features (mean, variance, autocorrelation, spectral energy, DTW Cost) blend with standard network features to generate a unified and multi-dimensional feature vector denoted as (X_packet), used as input to a supervised learning classifier trained to distinguish between normal and attacked sensor behavior.

$$X_{packet}=\left[\mu ,{\sigma }^2,R_{xx}\left(\tau \right),E_{spectral},Distance-cost\right]$$

where $\mathrm{\mu }$ is the mean, ${\sigma }^2$ is the variance, $R_{xx}\left(\tau \right)$ is the lag-based autocorrelation, $E_{spectral}$ is the FFT-based spectral energy, and $Distance-cost$ represents the extracted (DTW or Euclidean values).

Figure 3 shows an illustrative example of incongruence detected in a series, in which the attacker switched the sensor wires connecting sensors and processors in a simulated environment.

To explain the differences to the time series, we used the decomposition of different time series as several series of influential factors that could represent either normal or hazard situations. The explanations are these decompositions of influential factors in each of the parameters. When a hazard is detected, an explanation is provided. When an anomaly is detected, it provides the time series and the comparison with the most similar series to show the large differences. This module provides an estimation of which sensor(s) may be hacked according to the incongruencies.

• Temporal Split Protocol: To satisfy the operational constraints and prevent data leakage, we did not use standard random shuffling. Instead, we employ a forward-chaining (Time Series Split) protocol. Our protocol is structured as an expanding-window chronological validation framework; the training baselines expand cumulatively across successive iterations as shown in Figure 4. Formally, given a sanitized stream matrix containing N total chronological samples evaluated over K evaluation folds, the data is sliced into $k+1$ equal segments of size $M=\left[{\displaystyle \frac{N}{k+1}}\right]$. For any given fold index i (where i = 1, 2, …, K), the training matrix $X_{train}^{\left(i\right)}$ and testing matrix $X_{test}^{\left(i\right)}$ are defined as strict index boundaries:

  $$\begin{array}{c}{X}_{train}^{\left(i\right)}=X\left[0:i.M\right]\hfill \\ X_{test}^{\left(i\right)}=X[i.M:(i+1).M]\hfill \end{array}$$

Through this setup, the testing horizon is permanently restricted to an immediate, non-overlapping future window of size M, because the evaluation boundaries strictly track the forward chronological flow of network events; the tree ensemble classifier is completely insulated from future telemetry packets lengths or inter-arrival sequence intervals during the training, matching the real-world operational constraints of a live IoT intrusion detection deployment. Figure 4 shows that in detail.

3.3. Integration of Qualitative XAI

Given the safety-critical nature of environmental warning systems, explainability is a mandatory requirement. The proposed system integrates SHAP to interpret model outputs and quantify the contribution of each sensor feature to a classification decision.

The methodological integration of DTW-derived features and SHAP-based attributions addresses an inherent limitation in intemporal anomaly detection; while sequential metrics like DTW effectively map elastic timing variation into an single warping cost, they lack the resolution needed to isolate specific feature level vulnerabilities. By introducing the engineered distance cost vector as an explicit feature into the multi-dimensional ensemble classifier (XGBoost), the framework leverages SHAP to decompose the final decision boundary.

This allows the model to map global and local temporal variation alongside localized packet fields, enabling the system to explicitly distinguish between volumetric anomalies, application-layer exploits and structural routing disruptions.

Each time the anomaly detector identifies suspicious sensor behavior, SHAP values are computed to generate feature level explanations that clarify why a reading was labeled as an attack. For instance, a significant SHAP contribution from the gas sensor combined with a minimal contribution from other sensors could indicate targeted spoofing.

• In this work, we implement a methodologically sound, objective XAI validation instead of relying on subjective expert feedback.
• Casual Ground Truth Pre-registration: To eliminate “expert bias” or “cherry-picking”, as defined in

  Table 2. Casual Ground Truth pre-registration (XAI Alignment).

  Attack Type	Critical Protocol Feature	Expected SHAP Priority	Physical Justification
  MITM	arp.opcode/tcp.flags	High	Directly altered during packet interception.
  DDoS	tcp.ack/icmp.checksum	High	Result of packet volume and checksum mismatches.
  Ransomware	tcp.len/tcp.seq	High	Characteristics of encrypted data payload spikes.
  SQLi	http.request.uri	Medium	Pattern shifts in query length and structure.

  , we predefined the expected feature importance based on network protocol logic (e.g., an ARP spoofing attack must include arp.opcode).
• Feature Significance Alignment (FSA): We evaluated the SHAP outputs using Precision@ K feature overlap against the Casual Ground Truth. As shown in

  Table 3. Automated Quality Benchmarks for XAI Validation.

  Metric	Scientific Definition	Alignment Threshold	Role in Defense Framework	DTW Baseline	Euclidean Run
  Explaination Quality	Precision@ k feature alignment of SHAP vs. Causal Rules	Q > 0.50 (Strong)	Validates that model logic matches physical protocol physics.	0.6667 (Passed)	0.6000 (Passed)
  Model Detection (F1)	Cross fold mathematical capability across active classes	F1 > 0.9	Ensures High-fidelity threat isolation in real-time streaming traffic.	0.9967 (Passed-Fold 3)	0.9887 (Passed-Fold 1 Peak)
  Combined Score (Rcomb)	Balanced Performance/XAI Metric (α = 0.5)	Score > 0.80	Final “Trustworthiness” metric for safety-critical alerts.	0.8317 (passed-Stable)	0.7943 (Refusd/Failed)

  , we included all samples in these calculations, including those where the model logic is ambiguous, ensuring an honest reporting of the model’s internal reasoning across sequential deployment folds.
• Inter-Rater Reliability: We utilized multiple automated “raters” (Ground Truth vs. Model SHAP) and reported the alignment to ensure conclusions are not an artifact of a single expert’s interpretation.

The selection of validation thresholds is established based on operational constraints in critical IoT security infrastructures such as the following:

• Model detection threshold (F1 > 0.90): It is selected according to the industry benchmarks for industrial threat detection like EdgeIIoT-2022 [17]; in safety-critical telemetry routing, an F1-score below 0.90 introduces unacceptable false negatives, rates exposing critical infrastructure to intrusions.
• Explanation quality threshold (Q > 0.50): Based on the foundational metrics established in [21], a precision@ k feature overlap greater than 0.50 mathematically guarantees that the majority of the top ranked explanatory SHAP features are casually aligned with true network protocol physics rather than spurious statistical noise.
• Combined score threshold (R_Combined > 0.80): It represents a risk-tolerant operational limit [22]; in safety-critical systems, an automated response framework requires a composite metric above 0.80 to ensure that any deployed mitigation strategy is backed by both high classification accuracy and robust, auditable feature transparency, minimizing the risk of automated false alarms.

As displayed in the validation matrix, the baseline Euclidian framework fails to reach the critical deployable trust threshold (R > 0.80), yielding a combined score of only 0.7943 due to its lower feature explanation alignment (0.6000). On the other hand, the proposed DTW framework successfully passed all optimization thresholds, scoring a high trustworthiness value of (R = 0.8317); this practical divergence formally validates that dynamic sequence warping is necessary not just for raw tracking accuracy but for preserving the semantic interpretability of explanations in non-rigid IoT network environments.

3.4. Comparative Evaluation and Trade-Off Framework

To ensure a balanced assessment between detection performance and feature-level interpretability, a comparative evaluation framework is used. This framework considers both the detection performance metrics and the explanation quality metrics, enabling a multi-objective classification ranking:

• Performance Ranking Matrix: Classifiers are evaluated based on performance assessment metrics such as accuracy, precision, recall, F1-score, and AUC-ROC. Greater weight is assigned to recall, as detecting all possible perception-layer attacks is important for safety-critical applications.
• Combined Ranking: The explanation quality ratings and detection performance (F1) are combined to determine the final ranking, which is

R_combined = α · R_performance + (1 − α) · R_explanation

where α is a variable that establishes the proportional importance of accuracy against explainability, R_performance represents the practical macro F1-score achieved during Time Series Split validation, and R_explination tracks the explanation quality (Q) evaluated via precision@ k feature alignment.

3.

Alpha Sensitivity Sweep: We do not depend on a single arbitrary value for α; we conduct a sensitivity analysis across α ∈ {0.0, 0.25, 0.5, 0.75, 1.0}. This illustrates well how the model performs under different operational priorities ranging from pure accuracy to pure interpretability.

4.

Trade-Off Analysis: A trade-off curve (Pareto front) is generated to visualize the relationship between explanation quality and detection performance (F1-score). This helps identify optimal α (e.g., α = 0.5) that achieves a balance between robustness and interpretability.

3.5. Expected Contributions

The proposed approach provides a robust and explainable defense against perception-layer and MitM attacks in IoT-based environmental warning systems; the primary contributions of this work can be summarized as follows:

• Time-Series Detecting with Temporal Integrity: Detecting and isolating compromised sensors and malicious network interceptions using the hybrid (DTW + XGBoost) pipeline. Unlike traditional models, this approach is validated by using forward-chaining (Time Series Split) to ensure no temporal leakage, proving its reliability for real-time IoT streams.
• Objective XAI Validation: Providing interpretable SHAP- Based explanations that are quantitively validated. By replacing subjective expert review with a Casual Ground Truth alignment metric (quality-score calculated via Q), the system offers a mathematically sound measure of how well the model’s “reasoning” matches actual network protocol physics.
• Practical Component Validation: Using ablation research to demonstrate the necessity of each framework component. We showed that the integration of DTW significantly outperforms both standard Euclidean distance and rule-based baselines in high-noise IoT environments.
• Tunable Security-Explainability Trade-offs: Introducing a comparative evaluation framework that uses a sensitivity sweep over α. This allows system administrators to precisely tune the balance between raw detection performance (F1) and explicit structural transparency (Q-score) based on the specific safety requirements of the environmental monitoring site.

Through this integration of high-fidelity temporal feature engineering and rigorous XAI metrics, the proposed approach supports the development of reproducible, transparent, and resilient environmental monitoring systems capable of maintaining operational reliability even under adversarial conditions.

4. Experimental Evaluation and Results

4.1. Experimental Setup with System Overview and Prototype Configuration

Although all experiments and attacks were simulated in software, the architecture of the tested system is based on a real hardware functional prototype that has been assessed. This prototype serves as both a motivating deployment architecture and a physical benchmarking platform to practically verify that an edge microcontroller can handle the real-time processing demands of streaming feature extraction and local model inference, rather than relying on theoretical complexity models; we executed our feature extraction and decision logic directly on an ESP32 microcontroller to measure the physical operational latency, not as the source of benchmark data. The proto light (LDR), sound (microphone), temperature, and humidity (DHT11) were interfaced with an ESP32 microcontroller. The microcontroller performs local data acquisition, and data are transmitted over Wi-Fi to a backend server equipped with data analysis and alerting modules. The system’s conceptual design includes a buzzer and LCD screen for local alerts, as well as an Alexa-based voice interface for cloud notifications. Figure 5 introduces the architecture of the prototype with all the sensors and the specific module.

For presenting our hardware prototype, Figure 6 shows a picture of the hardware prototype, which is functional and detects environmental conditions. Alexa’s interface is also available for communicating with the system, in which users can not only talk with Alexa through its common interface and cloud software, but the hazards are also announced through Alexa’s notifications system. In addition, Figure 7 shows the components and sensors used in physical prototypes.

To evaluate the computational feasibility of the perception-layer defense, the real time execution overhead of the localized pipeline was profiled on the ESP32 microcontroller, and the hardware evaluation separates the computational cost of the streaming feature engineering phase (such as distance metric extraction) from the machine learning inference phase; under the continues evaluation, the feature latency (Feat Lat) remines tightly bounded between 32 µs and 33 µs, while the decision making inference latency step (Inf Lat) excites in only 14 µs to 16 µs, and the total end-to-end local processing latency is consistently below 0.05 ms (0.0470 ms to 0.490 ms). This extremely low computational footprint demonstrates that the proposed framework is highly viable for high-frequency, resource-constrained perception-layer devices, running locally without processing bottlenecks or requiring cloud offloading;

Table 4. Real-time hardware execution and latency benchmarks on ESP32.

Metrics	Measurement
Feature Latency (Feat Lat)	32 µs to 33 µs
Inference Latency (Inf Lat)	14 µs to 16 µs
Local Processing Latency	0.0470 ms to 0.490 ms

shows the details:

However, to ensure controlled experimentation and reproducibility, the entire sensing process was simulated in software using the EdgeIIoT-2022 [17] realistic dataset with scenarios of different attacks. They studied the realistic sensor behaviors shown by modeling their temporal dynamics, operational noise, and cross-correlations under various environmental conditions. Each sensor produces continuous time-series data reflecting the physical prototype.

The backend defense framework, consisting of the anomaly detection, XAI, and evaluation modules, was implemented entirely in software Python version: 3.13.7, NumPy version: 2.3.4, Pandas version: 2.3.3, scikit-learn version: 1.5.2, SHAP version: 0.50.0.

4.2. Dataset Composition

To ensure high external validity and address concerns regarding synthetic data, this study utilizes the EdgeIIoT-2022 dataset, a comprehensive benchmark for IoT security. The dataset captures authentic traffic from a large-scale IoT testbed, including protocols such as MQTT, HTTP, and DND including MitM, Ransomware, SQL injection, and various DDoS attacks (TCP, UDP, ICMP).

Attack Scenarios: Four types of perception-layer attack were studied to emulate malicious manipulations of sensor outputs:

• MitM Attack: Where the attacker places themself between two parties (the sensor and the controller or between controller and cloud) to intercept, eavesdrop, or alter the communication.
• SQL Injection Attack: An attack that allows us to interfere with the queries between applications and databases, enabling the attacker to view, modify or delete.
• Ransomware Attack: Publishes or encrypts IoT data or an IoT device system to prevent access until the victims pay the attacker a ransom.
• DDoS attack: Overwhelms a network or IoT controller or server with massive traffic to make it inaccessible.

Each attack type affected one or more sensors for a predefined time window, producing labeled data sequences for supervised learning.

Table 5. Threat coverage and defense relevance in the proposed approach.

Attack Category	Specific Attack Type	Training Samples	Testing Samples	Total Count	Relevance for IoT Warning Systems
Communication	Man-in-the-Middle (MitM)	1200	600	1800	Direct alteration of environmental alerts.
Application	Ransomware	1200	600	1800	Intercepts data between microcontroller and cloud.
Application	SQL Injection	1200	600	1800	Overwhelms the gateway to prevent alerts.
Network	DDoS (TCP)	1200	600	1800	Encrypt device data or interferes with db queries.
Network	DDoS (UDP)	1200	600	1800	Mitigated through SHAP-based interpretability.

shows that in detail.

4.3. Model Training and Evaluation Protocol

The proposed learning-based detection framework was implemented using XGBoost, selected for its high predictive performance and compatibility with SHAP.

• To eliminate the risk of temporal leakage identified in previous versions, the 30/70 random split was replaced with the Block Forward-Chaining protocol.
• Windowing: Features were constructed using a sliding window of size 10 with no overlap across the training/testing boundary.
• Validation: A 3-fold Time Series Split was used. This ensures the model is always evaluated on “future” data relative to its training set, accurately reflecting real-world deployment in environmental warning systems.

Figure 8 shows the results of the accuracy, precision, recall and F1-score for identifying each of the attacks with each of the learning models.

4.4. Baseline Comparison and Performance

The proposed learning-based detection framework was implemented using XGBoost, selected for its high predictive performance and compatibility with DTW and compared against two task-specific baselines to substantiate the necessity of each component:

• Rule-Based Detector: A threshold-based system using mean/standard deviation of normal traffic.
• DTW-Only Detector: A baseline utilizing only the DTW cost without the ensemble classifier.

Results Analysis: As shown in

Table 6. Consolidated performance comparison.

Attack Category	Proposed (Hybrid DTW)	Baseline: DTW-Only	Proposed (Hybrid Euclidean)	Baseline: Euclidean-Only	Baseline: Rule-Based
MITM	0.9915	0.9631	1.0000	0.9631	0.1748
DDoS_TCP	1.0000	0.9414	0.9485	0.9414	0.0000
Ransomware	0.9983	0.9568	0.9967	0.9568	0.0000
SQL_injection	0.9985	0.9483	0.953	0.9483	0.0000
DDoS_UDP	0.9920	0.9414	0.9485	0.9414	0.0000

, the proposed framework achieved an average F1-score of 0.99 for MitM and 0.96 for Ransomware, vastly outperforming the rule-based baseline (F1 is about 0.17) and the DTW-only baseline (F1 about 0.96).

Ablation Study: Replacing DTW with Euclidean distance resulted in a drop in F1-score across most of the attack types, confirming that temporal warping alignment is critical for detecting sophisticated perception-layer manipulations.

4.5. Quantitative Explainability Trade-Off Evaluation

The explanation quality was evaluated using (Q) against pre-registered Casual Ground Truth.

• No Exclusions: To ensure methodological rigor, 100% of samples were included in the evaluation; no “ambiguous” cases were excluded, removing any upward bias in the scores.
• Alpha α Sensitivity Sweep: We report the results of a sensitivity analysis where α was varied from 0.0 to 1.0 (

  Table 7. α Sensitivity data for trade-off analysis.

  Weight (α)	Priority Focus	Avg. Detection (F1)	Explanation Quality (ρ)	Rcom
  α = 1.0	Pure Performance	$0.9967\pm 0.0010$	$0.6667\pm 0.0000$	$0.9967\pm 0.0010$
  α = 0.75	High Performance	$0.9967\pm 0.0010$	$0.6667\pm 0.0000$	$0.9142\pm 0.0007$
  α = 0.50	Symmetric Balanced	$0.9967\pm 0.0010$	$0.6667\pm 0.0000$	$0.8317\pm 0.0005$
  α = 0.25	High Explainability	$0.9967\pm 0.0010$	$0.6667\pm 0.0000$	$0.7492\pm 0.0002$
  α = 0.0	Pure Explainability	$0.9967\pm 0.0010$	$0.6667\pm 0.0000$	$0.6667\pm 0.0000$

  ).
• For all target attack vectors including MitM, the explanation quality metric achieved a stable baseline alignment score of 0.67, confirming strong structural transparency.

The multi-class sensitivity trade-off curve (Figure 9) demonstrates that the symmetric balance configuration (α = 0.5) in the framework achieves an optimal system equilibrium (maintaining a near-perfect F1-score (0.9967)) while ensuring the explanations remain casually consistent with network protocol logic.

4.6. Error Analysis

Confusion matrices were generated for all attack categories. For critical threats like SQL Injection and MitM, the model showed near-perfect MITM rates specifically (Figure 10). This confirms that the framework satisfies the operational constraint of safety-critical systems, where failing to detect an attack is significantly more dangerous than a false alarm.

4.7. Evaluation of the Detected Attacks

To further evaluate a wide range of attacks,

Table 8. Threat coverage and defense relevance (✓: detected).

Attack Category	Attack Type/Target	Detected by Proposed System	Relevance for IoT Warning Systems
Perception-Layer	Sensor Spoofing/Injection	✓	Direct alteration of environmental alerts.
Communication	Man-in-the-Middle (MitM)	✓	Intercepts data between microcontroller and cloud.
Communication	DDoS (TCP, UDP, ICMP)	✓	Overwhelms the gateway to prevent alerts.
Application	Ransomware & SQL Injection	✓	Encrypt device data or interferes with db queries.
XAI Validation	Misleading/Opaque Decisions	✓	Mitigated through SHAP-based interpretability.

presents the results of evaluating different attack types categorized in different categories in the proposed system. It indicates whether each attack was detected by the proposed system, or whether it is planned or under evaluation. It also briefly explains their relevance for IoT environmental warning systems.

5. Discussion

The experimental results using an authentic EdgeIIoT-2022 dataset confirm that perception-layer and MitM attacks can be effectively modeled and detected through the proposed hybrid DTW-XGBoost pipeline. By utilizing real-world network traffic rather than synthetic Gaussian processes, this study achieves higher external validity and demonstrates that the defense mechanism is resilient to the noise and complexity of actual IoT environments.

A significant challenge in current XAI research is the reliance on ad hoc or subjective evaluation metrics, such as the Window-based Attribution Mean Square Error (WAE) used in [23], which focuses more on the accuracy of time series rather on the quality of explanations. To address the limitation of the subjective expert review (which can introduce “rater bias” and upwardly biased scores) identified in [12], this study transitioned to an objective, mathematically sound validation framework. By pre-registering a Casual Ground Truth based on network protocol specifications, we evaluated explanation stability using strict (Q) metrics (k = 3) against these expert anchors [21]; we eliminated the need for manual expert evaluation. This protocol ensures that the reported explanation quality scores (e.g., =0.67 for MitM indicating 2/3 structural feature alignment) are reproducible and free from the bias of “excluded cases” or “expert doubt” seen in qualitative XAI studies [24].

Component Necessity and the Novelty of Combination: This ablation study confirms that the hybrid nature of this approach is its primary strength. While XGBoost provides high classification power, the engineered DTW features provide necessary temporal context to detect subtle shifts in packet rhythm. Because the real-world IoT traffic is inherently noisy and temporally not rigid, standard Euclidian distance measurements fail to capture matching patterns when packet sequence lengths stall or shift slightly in time. By dynamically warping the temporal axis, our integrated DTW-XGBoost pipeline successfully extracts structural anomalies within complex, un-aligned streaming datasets, ensuring high-fidelity detection where rigid distance baselines degrade. The integration of these components, validated through a forward-chaining temporal split, ensures that the system is not only accurate but also structurally aligned with the temporal dynamics of IoT security.

The introduction of the α-tunable trade-off framework addresses the operational reality that different IoT environments have different priorities. In safety-critical systems, such as environmental hazard detectors, a higher weight on explainability (α − 0) ensures that human responders can verify the cause of an alert before acting, whereas high-traffic gateways may prioritize raw throughput and detection speed (α − 1).

Finally, the use of a blocked/forward-chaining split ensures that the reported performance metrics (near-perfect F1-score for DDoS and MitM) are not inflated by temporal leakage [25]. This provides a more realistic estimate of the system performance in real-world, time-ordered deployment.

6. Conclusions and Future Work

This work proposed a statistically validated framework for defending IoT environmental danger warning systems against perception-layer and MitM attacks. By utilizing the EdgeIIoT-2022 dataset, the system’s performance was evaluated against authentic network threats including MitM, Ransomware, SQL Injection, and DDoS variants. The system emulates a prototype integrating gas, light, sound, temperature, and humidity sensors whose data are processed and transmittedto a cloud backend for risk alerts.

The proposed defense combines temporal feature engineering through DTW with XGBoost classifier, optimized through a forward-chaining temporal spilt to ensure the absence of leakage. The empirical results, substantiated by a comprehensive ablation study, demonstrate that the integration of DTW cost as a feature is essential for high-fidelity detection, significantly out-performing rule-based and Euclidian-distance baselines. Specifically, the framework achieved a near-perfect F1-score (0.99) for MitM attacks, proving its efficacy in securing the link between sensors and cloud backends.

A core contribution of this research is the qualitative validation of explainability. By replacing subjective expert review with an objective (Q) metric (k = 3) calculated against a pre-registered Casual Ground Truth, we established a reproducible measure of explanation quality (0.67). Furthermore, the introduction of an α-tunable trade-off framework (validated through a sensitivity sweep) provides system administrators with mathematical tools to balance raw detection performance against structural transparency.

While this study successfully validated the microsecond-level execution and operational latency of the localized pipeline on physical ESP32 hardware, future work will focus on deploying the complete end-to-end framework in fully decentralized, multi-node production environments (transitioning from EdgeIIoT-2022 benchmark to live testing on distributed physical IoT testbed), study cross-sensor correlations (extending the current DTW analysis to study cross-sensor correlations, enabling the detection of sophisticated attacks that simultaneously manipulate multiple environmental parameters), and explore adaptive online learning to handle evolving attack types (the integration of incremental learning algorithms to maintain high detection recall as attack patterns evolve in dynamic IoT ecosystems). Further integration of advanced explainability techniques and user studies will strengthen the framework’s applicability and human trustworthiness in critical IoT-based safety infrastructures.