Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments Amira Berrezzek
Hayet Djellali
Giulio Mallardi
Lamia Mahnane
arXiv:2608.00869v1 [cs.CR] 1 Aug 2026
Computer Science Dept. Computer Science Dept. Computer Science Dept. Computer Science Dept. Badji Mokhtar University University of Bari Badji Mokhtar University Badji Mokhtar University Annaba, Algeria Bari, Italy Annaba, Algeria Annaba, Algeria [email protected] [email protected] [email protected] [email protected] Abstract—Internet of Medical Things (IoMT) networks are hard to protect: devices are heterogeneous, computing resources are scarce, and traffic must be analyzed in real time. We present an intrusion detection system that addresses these constraints through feature selection. A Pearson correlation filter first removes redundant attributes; a hybrid strategy then combines model-based feature importance with SHAP attribution to pick a compact subset, on which we train Random Forest and LightGBM classifiers. SHAP and LIME explain what each retained feature contributes to the decisions. On CIC-IoMT 2024 and CIC-IDS 2017, the method cuts the feature space by up to 88% – from 40 to as few as 5 features – and accuracy and F1-score stay within a few points of models trained on all features. Compact, interpretable detectors of this kind are practical candidates for deployment on resource-limited medical networks. Index Terms—Internet of Medical Things, intrusion detection, hybrid feature selection, explainable AI, LightGBM, network security
I. I NTRODUCTION The Internet of Medical Things (IoMT) is transforming healthcare by enabling continuous monitoring, remote diagnostics, and data-driven care. At the same time, device heterogeneity, limited resources, and real-time constraints widen the attack surface, making IoMT networks attractive targets for sophisticated cyberattacks [1]. Protecting sensitive medical data exchanged across such infrastructures, therefore, remains a critical challenge. Intrusion Detection Systems (IDS) are a key defense mechanism for identifying malicious traffic. In recent years, machine learning approaches—including ensemble methods such as Random Forest (RF) [2] and LightGBM [3]— have shown strong performance on high-dimensional network data [4]. However, IoMT traffic typically contains many redundant and irrelevant features, which can increase computational cost, reduce generalization, and hinder interpretability [5]. Feature selection is thus essential to retain discriminative information while reducing dimensionality. Beyond accuracy, IoMT security applications increasingly require transparency. Explainable AI (XAI) techniques such as SHAP [6] and LIME [7] provide global and local insights into model decisions, supporting trust and adoption in safetycritical settings. Nevertheless, many IoMT IDS solutions still treat feature selection and explainability as separate steps,
limiting the interpretability of the selected feature subset and the trustworthiness of the resulting models. To address this gap, we propose a feature selection framework in which explainability is part of the selection itself, not an afterthought. A Pearson correlation filter first discards redundant attributes; the surviving features are then ranked twice, once by modelbased importance and once by SHAP attribution, and the two rankings are merged into a single compact subset. We train RF and LightGBM on these subsets and use SHAP and LIME to explain the resulting models at the global and local level. Across CIC-IoMT 2024 and CIC-IDS 2017, the subsets shrink to 5–13 features out of 40–70 with little loss in detection performance. This work makes three contributions: • a feature selection pipeline that merges correlation filtering, model-based importance, and SHAP attribution into compact, explainable subsets; • experiments with RF and LightGBM on two benchmarks, under several selection strategies, that quantify how much accuracy costs each feature removed; • a SHAP and LIME analysis that ties the selected features to the traffic patterns behind intrusion decisions in IoMT networks. Section II reviews related work, Section III describes the architecture, Section IV presents the results, and Section V concludes. II. BACKGROUND AND M ETHODS A. Related Work Zukaib et al. in [8] highlight that the Internet of Medical Things (IoMT) is vulnerable to cyberattacks, requiring advanced intrusion detection. They proposed a meta-learning based Meta-IDS, combining signature-based and anomalybased techniques. It was evaluated on the WUSTL-EHMS2020, IoTID20, and WUSTL-IIOT-2021 datasets, achieving up to 99.99% accuracy. Following this approach, Salehpour et al. in [9] proposed a resource-efficient IoMT IDS using two-step feature selection with Random Forest classification. It was evaluated on WUSTL-EHMS-2020, NSL-KDD, and CIC-IoMT2024,
achieving high accuracy, especially for DDoS/DoS attacks. In a different direction, Augusta et al. in [10] introduced a Blockchain-enabled IoMT healthcare system with a hybrid IDS using Enhanced Artificial Bee Colony (E-ABC) and Deep Belief Network (DBN). The approach combines optimization with deep learning to enhance detection performance in IoMT settings. Similarly focused on feature selection and classification, Geetha et al. in [11] proposed an IoT-IDS using Chaotic Vortex Search (CVS) for feature selection and Fast-Learning Network (FLN) for classification. Evaluated on CIC IDS-2017 and BoT-IoT datasets, it achieved up to 99.7% accuracy and a 99.81% detection rate. In the same context of ensemble learning, Abdullah et al. in [12] proposed a web intrusion detection model for IoMT using ensemble learning with XGBoost, KNN, Decision Tree, Random Forest [2], and AdaBoost. Evaluated on medical system traffic data, XGBoost achieved 99.67% accuracy with P < 0.001, while ROC-AUC scores were very high across classifiers. On another note, Kumari et al. in [13] proposed an IDS using Gravitational Search Algorithm (GSA) for feature selection, Synthetic Minority Over-sampling Technique Iterative Partitioning Filter (SMOTE-IPF) for data balancing, and ML classifiers. Random Forest achieved 99.6% and 94.4% accuracy on the NSL-KDD and UNSW-NB15 datasets, respectively. Similarly, Zeghida et al. in [14] introduced an IoT intrusion detection system using ensemble learning (bagging, boosting, and stacking) on a balanced MQTT dataset. Compared to single ML models, the approach improved prediction performance, achieving up to 95% accuracy and F1-score, with MCC exceeding 90%. Moving towards hybrid anomaly detection, Zachos et al. in [15] proposed an anomaly-based IDS (AIDS) for IoMT networks using novelty and outlier detection techniques. In contrast to heavier models, results show very low computational overhead, with CPU usage below 1%, making it suitable for resource-constrained IoMT environments. Building on ensemble learning frameworks, Arreche et al. in [16] proposed a two-level ensemble learning framework for network intrusion detection. Following the trend of integrating explainability, it combines multiple ensemble techniques with XAI-based feature selection [17], and was evaluated on RoEduNet-SIMARGL2021, NSL-KDD, and CICIDS-2017 using standard metrics. Finally, Arreche et al. in [18] extended this line of research by proposing an end-to-end framework for evaluating black-box XAI methods [17] in IDS. Similar to previous studies emphasizing explainability, SHAP and LIME were assessed globally and locally on three benchmark datasets, highlighting the strengths and limitations of current XAI techniques in IDS applications. Despite these advances, most existing works treat feature selection and explainability as separate processes. Only limited studies integrate explainability directly into the feature selection stage to obtain compact and interpretable feature subsets. This limitation motivates the proposed hybrid explainable feature selection framework, which jointly optimizes detection performance and interpretability for IoMT intrusion detection.
B. Explainable AI and Feature Selection Background Feature selection is a crucial preprocessing step that aims to identify the most discriminative attributes by removing irrelevant and redundant variables, thereby improving model efficiency and preserving the most informative features [5]. Explainable Artificial Intelligence (XAI) refers to a set of techniques designed to clarify how machine learning models produce their predictions, enabling human users to interpret and understand the reasoning behind the outputs. This is particularly important in high-stakes domains such as healthcare and cybersecurity, where transparency and trust are essential [17]. SHapley Additive exPlanations (SHAP) is a widely used XAI method based on game theory that assigns each feature a contribution score to the model output. It provides both global and local interpretability, enabling the identification of the most influential features [6]. Local Interpretable Modelagnostic Explanations (LIME) is a technique that explains individual predictions by approximating the original model locally with an interpretable surrogate model, allowing analysis of the features driving specific intrusion detection decisions [7]. III. P ROPOSED H YBRID F EATURE S ELECTION A RCHITECTURE A. Overview of the Proposed Framework The framework is organized as a pipeline. Preprocessing handles missing and infinite values and normalizes feature distributions. A Pearson correlation filter (|r| > 0.9) then discards highly correlated attributes, so the ranking steps operate on non-redundant features. The hybrid stage scores each surviving feature by model-based importance and by SHAP attribution, and the two scores together decide which attributes are kept. Finally, Random Forest and LightGBM are trained on the resulting subsets, and SHAP and LIME explain the trained models – SHAP at the level of overall feature contributions, LIME on individual predictions. B. Datasets The CIC-IoMT-2024 dataset [19], developed by the Canadian Institute for Cybersecurity, is a benchmark for IoMT security research. It contains realistic network traffic from 40 devices (25 real, 15 simulated). The dataset includes benign traffic and 18 simulated attacks, mainly DoS and DDoS [19]. This study focuses on the Wi-Fi and MQTT data. In this work, the dataset is used for binary classification (benign vs. attack) by grouping the considered attack types into a single malicious class. The corresponding files were merged and shuffled, then split into training (70%) and testing (30%) sets. The dataset contains 40 features, and no manual feature removal was performed before the feature selection stage. CIC-IDS 2017 [20] is an intrusion detection dataset containing benign traffic and various network attacks. It includes flow records labeled with timestamps, IPs, ports, protocols, and attack types. Traffic was generated over five days using
realistic user profiles and common protocols. Due to its large size (approximately 2,830,540 samples with 79 features), we created a balanced subset of 100,000 samples, including 50,000 benign and 50,000 attack instances. In addition, redundant attributes were removed, resulting in 70 features used in our experiments. The subset was then split into training (70%) and testing (30%) sets. C. Data Pre-Processing To prevent data leakage, each dataset was first split into training and test sets. All preprocessing steps, including imputation, normalization, and hybrid feature selection, were performed using only the training data and then consistently applied to the test set. Class labels were encoded in binary form, where 0 denotes benign traffic and 1 denotes attack traffic. A rigorous data pre-processing pipeline was applied to the CIC-IoMT2024 dataset to ensure data quality and effective model training. First, infinite values were identified and removed, as they can disrupt machine learning algorithms. Next, missing values were handled using median imputation to preserve the data distribution. Finally, Z-score standardization was applied to all numerical features to normalize their scales and ensure balanced model learning. A streamlined preprocessing pipeline was applied to the CIC-IDS2017 dataset to ensure its suitability for intrusion detection modeling. Selected traffic files were concatenated into a unified dataset for analysis. Missing and infinite values were handled, and irrelevant features were removed to improve data quality and reduce dimensionality, and duplicate records were eliminated. Finally, the dataset was split into training and testing sets, and Min-Max normalization was applied to scale features for stable model training. Since both classifiers are tree-based and invariant to monotonic feature transformations, the different scalers do not affect detection performance; scaling mainly ensures comparable standardized thresholds in the LIME explanations. D. The proposed Model The core contribution of this work is an explainabilitydriven feature selection layer that combines model-based feature importance (A) with SHAP-based explanations (B). The Hybrid Feature Selection (HFS) strategy is defined as: HFS = (A ∩ B) + 95% · (A − B)
(1)
where A represents the set of features selected using model-based feature importance and B represents the set selected using SHAP importance. The intersection ensures agreement between both methods, while the additional features retained from A preserve predictive information identified by the model. In practice, the 95% threshold corresponds to retaining the top 95% of features according to the Feature Importance ranking used to construct A. For example, if Feature Importance initially selects 20 features, the top 19 features are retained. This threshold was empirically determined among candidate values in the 80–100% range, as it provided the
best trade-off between dimensionality reduction and detection performance in preliminary experiments. Random Forest was trained with 100 trees, while LightGBM was trained using its standard configuration. All results were obtained using the same train/test split and preprocessing pipeline described above. The selected features are then used to retrain both models, and performance is evaluated using standard classification metrics and confusion matrices. Fig. 1 illustrates the overall architecture. Data Pre-processing CIC IoMT 2024 Dataset
CIC IDS 2017 Dataset
Training and Testing Random Forest
LightGBM
Feature Selection
Feature Importance (A)
SHAP (B)
HFS = (A ⋂ B) + 95% of (A - B)
RF + Hybrid Feature Selection
LGBM + Hybrid Feature Selection
Performance Evaluation Compute Confusion Matrix
Compute Accuracy, Precision, Recall, F1-Score, AUC
Fig. 1. Proposed Architecture
IV. R ESULTS In the following tables, “+ SHAP” and “+ FI” indicate that the classifier was trained and evaluated using the feature subset selected based on SHAP importance and model-based feature importance, respectively, rather than using SHAP solely for post-hoc explainability. On the CIC-IoMT 2024 and CIC-IDS 2017 datasets, the results highlight both the effectiveness of Random Forest and LightGBM and the impact of feature selection strategies. A. CIC-IoMT 2024 Dataset Without the Pearson correlation filter, the baseline Random Forest achieves 97.8% accuracy and F1-score, confirming strong classification performance. Applying SHAP and Feature Importance individually slightly reduces accuracy, while the hybrid approach maintains competitive results (97.2% accuracy, 99.4% recall) by combining interpretability and feature relevance into a compact subset. With the Pearson filter, performance further improves to 98.0% accuracy and F1-score, indicating that removing highly correlated features reduces redundancy and enhances generalization.
TABLE I P ERFORMANCE M ETRICS OF R ANDOM F OREST ON THE CIC I O MT 2024 DATASET, W ITH AND W ITHOUT PC F ILTERING Without Pearson Correlation Filter Precision Recall F1-score 0.961 0.996 0.978 0.960 0.991 0.975 0.950 0.994 0.971 0.952 0.994 0.972 With Pearson Correlation Filter Accuracy Precision Recall F1-score 0.980 0.964 0.998 0.980 0.976 0.957 0.998 0.977 0.970 0.948 0.996 0.971 0.978 0.985 0.971 0.978 Accuracy 0.978 0.975 0.971 0.972
RF RF + SHAP RF + FI Hybrid RF
RF RF + SHAP RF + FI Hybrid RF
RF RF + SHAP RF + FI Hybrid RF
AUC 0.999 0.999 0.997 0.996
RF RF + SHAP RF + FI Hybrid RF
0.986
0.95
0.961
0.95
0.960
0.962 0.960
0.963 0.961
0.96
Recall (With Pearson) Recall (Without Pearson) F1-score (With Pearson)
nce
AP
+ SH LGBM
LGBM
porta ature Im
+ Fe
Fig. 3. LightGBM On CIC-IoMT 2024
B. CIC-IDS 2017 Dataset
F1-score (Without Pearson) AUC (With Pearson) AUC (Without Pearson)
0.928
Accuracy (With Pearson) Accuracy (Without Pearson) Precision (With Pearson) Precision (Without Pearson)
0.931 0.929
LGBM
0.94
BM
LG Hybrid
0.999 0.998 0.999 0.999 0.999 0.997 0.999 0.998 0.999 0.999
0.999 0.999 0.985
0.980 0.975
Accuracy (With Pearson) Accuracy (Without Pearson) Precision (With Pearson) Precision (Without Pearson)
t om Fores
Rand
0.94 0.93
0.97 0.96
0.976
0.97
0.999
0.99
Score
0.999 0.998
0.995 0.998 0.985
0.98
0.995 0.994 0.999 0.999 0.990 0.990 0.995 0.994 0.999 0.999
0.999 0.997
0.997 0.995
0.996 0.995 0.996 0.995 0.996 0.995 0.996 0.995 0.999 0.999
1.00
AUC 0.999 0.998 0.999 0.999
Random Forest Variants on CIC IDS 2017 With vs Without Pearson Correlation Filter
1.00
0.98
LightGBM Variants on CIC IoMT 2024 With vs Without Pearson Correlation Filter
AUC 0.999 0.999 0.999 0.999
On the CIC-IDS 2017 dataset, LGBM shows excellent intrusion detection performance. Baseline LGBM reaches 99.8% accuracy, precision, recall, and F1-score. SHAP slightly lowers performance, while Feature Importance and Hybrid LGBM maintain near-optimal results. With the Pearson filter, LGBM + FI stays at 99.9%, and Hybrid LGBM remains strong (99.7%), balancing performance, feature reduction, and explainability. 0.999 0.996 0.999
On the CIC-IoMT 2024 dataset, LightGBM shows excellent performance across all settings. Without Pearson correlation filtering, the baseline LGBM achieves 99.5% accuracy and F1-score (AUC 99.9%), while the hybrid method maintains high recall (99.5%) but lower overall accuracy (96.0%). With correlation filtering, results become more balanced: the baseline reaches 99.6% accuracy and F1-score, and the hybrid model attains 98.5% accuracy and 98.6% F1-score using only 13 of the 40 original features, trading roughly one accuracy point for a 67% reduction of the feature space.
LGBM LGBM + SHAP LGBM + FI Hybrid LGBM
0.999
AUC 0.999 0.999 0.999 0.999
LGBM LGBM + SHAP LGBM + FI Hybrid LGBM
Without Pearson Correlation Filter Precision Recall F1-score 0.998 0.998 0.998 0.992 0.996 0.994 0.999 0.999 0.999 0.999 0.999 0.999 With Pearson Correlation Filter Accuracy Precision Recall F1-score 0.997 0.997 0.998 0.997 0.988 0.980 0.997 0.988 0.999 0.999 0.999 0.999 0.997 0.996 0.997 0.997 Accuracy 0.998 0.994 0.999 0.999
0.984
AUC 0.999 0.997 0.999 0.998
0.974
LGBM LGBM + SHAP LGBM + FI Hybrid LGBM
Without Pearson Correlation Filter Precision Recall F1-score 0.995 0.995 0.995 0.929 0.995 0.961 0.999 0.990 0.994 0.928 0.998 0.961 With Pearson Correlation Filter Accuracy Precision Recall F1-score 0.996 0.996 0.996 0.996 0.962 0.931 0.997 0.963 0.995 0.999 0.990 0.995 0.985 0.976 0.995 0.986 Accuracy 0.995 0.960 0.994 0.960
TABLE IV P ERFORMANCE M ETRICS OF L IGHT GBM ON THE CIC-IDS 2017 DATASET, W ITH AND W ITHOUT PC F ILTERING
0.999
RF
0.994
Hybrid
0.994 0.997
LGBM LGBM + SHAP LGBM + FI Hybrid LGBM
Score
AUC 0.999 0.994 0.999 0.999
0.989
0.952
e
portanc
0.985
ature Im
RF + Fe
TABLE II P ERFORMANCE M ETRICS OF L IGHT GBM ON THE CIC-I O MT 2024 DATASET, W ITH AND W ITHOUT PC F ILTERING
0.92
AUC 0.999 0.999 0.999 0.999
On the CIC-IDS 2017 dataset, Random Forest shows excellent performance across all feature selection strategies. The baseline RF achieves 99.8% accuracy and F1-score, and 99.9% AUC, while the hybrid approach maintains similar accuracy and F1-score with a high recall of 99.7%, preserving key features from SHAP and Feature Importance. Applying the Pearson correlation filter further improves consistency, with RF + FI and Hybrid RF reaching up to 99.9% in all metrics, demonstrating the value of removing redundant features.
0.985 0.988
0.972
0.978
0.985 0.978 0.972
0.971
0.971 0.971
0.970 0.971
0.957 0.960
AP
RF + SH
Fig. 2. Random forest On CIC-IoMT 2024
0.99
Without Pearson Correlation Filter Precision Recall F1-score 0.999 0.998 0.998 0.980 0.997 0.989 0.974 0.996 0.985 0.999 0.997 0.998 With Pearson Correlation Filter Accuracy Precision Recall F1-score 0.997 0.997 0.998 0.997 0.985 0.975 0.994 0.985 0.999 0.999 0.999 0.999 0.999 0.999 0.999 0.999 Accuracy 0.998 0.988 0.984 0.998
0.997 0.998 0.997 0.999 0.998 0.998 0.997 0.998 0.999 0.999
F1-score (Without Pearson) AUC (With Pearson) AUC (Without Pearson) 0.996 0.997
Recall (With Pearson) Recall (Without Pearson) F1-score (With Pearson)
0.994
0.997 0.999
0.996 0.994
0.999 0.999 0.977 0.975
0.976 0.975
0.980 0.978
0.980 0.978
RF
0.948 0.950
0.94
0.964 0.961
Score
0.98
0.95
Accuracy (With Pearson) Accuracy (Without Pearson) Precision (With Pearson) Precision (Without Pearson)
0.991
0.998
0.999 0.999
0.998 0.996
0.99
0.96
AUC 0.999 0.999 0.999 0.997
Random Forest Variants on CIC IoMT 2024 With vs Without Pearson Correlation Filter
1.00
0.97
TABLE III P ERFORMANCE M ETRICS OF R ANDOM F OREST ON THE CIC-IDS 2017 DATASET, W ITH AND W ITHOUT PC F ILTERING
Recall (With Pearson) Recall (Without Pearson) F1-score (With Pearson)
F1-score (Without Pearson) AUC (With Pearson) AUC (Without Pearson)
RF + SH
AP
e portanc
ature Im RF + Fe
Hybrid
Fig. 4. Random Forest On CIC-IDS 2017
RF
0.96 0.95 0.94
Accuracy (With Pearson) Accuracy (Without Pearson) Precision (With Pearson) Precision (Without Pearson)
Recall (With Pearson) Recall (Without Pearson) F1-score (With Pearson)
LGBM
F1-score (Without Pearson) AUC (With Pearson) AUC (Without Pearson)
LGBM
+ SHAP LGBM
rtance
Hybrid
re Impo
+ Featu
LGBM
Fig. 5. LightGBM On CIC-IDS 2017
C. Feature Selection and Explainability Results TABLE V N UMBER OF F EATURES S ELECTED BY THE P ROPOSED H YBRID F EATURE S ELECTION M ETHOD Hybrid RF Hybrid LGBM
CIC-IoMT 2024 5 13
10
High
IAT Feature value
rst_flag_number psh_flag_number ack_flag_number 0.6
0.4
0.2
0.0
0.2
0.4
SHAP value (impact on model output)
0.6
Low
Fig. 6. Feature Impact Analysis of RF on the CIC IoMT 2024 Dataset TABLE VI LIME E XPLANATION FOR R ANDOM F OREST ON THE CIC I O MT 2024 DATASET Feature IAT syn flag number psh flag number rst flag number ack flag number
Condition ≤ −0.83 ≤ −0.73 ≤ −1.29 ≤ −0.68 > 0.80
0
5
Low
10
Fig. 7. Feature Impact Analysis of LGBM on the CIC IoMT 2024 Dataset
These results correspond to a substantial reduction of the original feature space while maintaining high detection performance.
syn_flag_number
5
SHAP value (impact on model output)
CIC-IDS 2017 12 8
Value 0.562935 -0.015965 0.006832 -0.006471 0.001241
These LIME results indicate that IAT (Inter-Arrival Time) is the most critical predictor, where low values (IAT ≤ −0.83) strongly push the Random Forest toward a specific classification (likely Malicious) with a high local weight of 0.563. Other features like syn and rst flag counts show negative contributions, while ack flags over a threshold provide a marginal positive influence, collectively defining the model’s decision boundary for IoMT traffic.
TABLE VII LIME E XPLANATION FOR LGBM ON THE CIC I O MT 2024 DATASET Feature IAT Rate fin flag number Std Max
Condition ≤ −0.83 > 0.36 ≤ −0.52 ≤ −0.59 ≤ −0.88
Value 0.474506 0.169202 -0.053231 0.030717 0.029507
The LIME local explanation for the LightGBM model on the CIC IoMT 2024 dataset reveals that the Inter-Arrival Time (IAT) and traffic Rate are the primary drivers for this specific classification, where an IAT ≤ −0.83 yields the highest contribution weight (0.474506) toward the prediction. This suggests that the model identifies rapid, high-frequency packet patterns characterized by low inter-arrival times and high rates as the critical diagnostic signatures for distinguishing malicious IoMT anomalies from benign medical device telemetry. This signature is consistent with the flooding behavior of the DoS/DDoS attacks that dominate the dataset [19]. High
Packet Length Variance Destination Port Bwd Packet Length Max Packet Length Mean Init_Win_bytes_backward Fwd Packet Length Max Fwd Packet Length Mean Total Length of Fwd Packets Bwd Packet Length Min Flow IAT Mean Init_Win_bytes_forward Fwd Packet Length Min
Feature value
0.97
IAT syn_flag_number Rate rst_flag_number fin_flag_number Max Tot sum psh_flag_number Time_To_Live Min Header_Length Std HTTPS
Feature value
0.997 0.999 0.996 0.999 0.997 0.999 0.997 0.999 0.999 0.999
0.999 0.999 0.999 0.999 0.999 0.999 0.999 0.999 0.999 0.999
0.997 0.996
0.994 0.998 0.999 0.988
0.988 0.980
0.98 Score
0.992
0.994
0.997 0.998 0.997 0.998 0.998 0.998 0.997 0.998 0.999 0.999
0.99
High
LightGBM Variants on CIC IDS 2017 With vs Without Pearson Correlation Filter
1.00
0.3
0.2
0.1
0.0
0.1
0.2
SHAP value (impact on model output)
0.3
Low
Fig. 8. Feature Impact Analysis of RF on the CIC IDS 2017 Dataset
For the CIC IDS 2017 dataset with Random Forest, LIME identifies Destination Port and Packet Length Variance as the dominant localized features, where specific port targeting and high payload irregularity serve as high-weight indicators (> 0.10) for detecting sophisticated network intrusions.
TABLE VIII LIME E XPLANATION FOR RF ON THE CIC IDS 2017 DATASET Feature Destination Port Packet Length Variance Init Win bytes backward Bwd Packet Length Max Bwd Packet Length Min
Condition ≤ 0.00 > 0.10 ≤ 0.00 > 0.25 ≤ 0.00
Value 0.198658 0.107942 0.040776 0.032947 0.031143 High
Feature value
Bwd Packet Length Max Fwd Packet Length Max Destination Port Init_Win_bytes_backward Total Length of Fwd Packets URG Flag Count Total Fwd Packets Fwd IAT Min 4
2
0
2
4
SHAP value (impact on model output)
6
Low
Fig. 9. Feature Impact Analysis of LGBM on the CIC IDS 2017 Dataset TABLE IX LIME E XPLANATION FOR LGBM ON THE CIC IDS 2017 DATASET Feature Destination Port Bwd Packet Length Max URG Flag Count Fwd Packet Length Max Fwd IAT Min
Condition ≤ 0.00 > 0.25 ≤ 0.00 ≤ 0.00 ≤ 0.00
Value 0.294631 0.112012 0.060921 -0.045540 0.034684
LIME confirms that LightGBM prioritizes the Destination Port and Bwd Packet Length Max as the most influential predictors, where specific port targeting and significant backward packet size variability provide a combined contribution weight exceeding 0.40 toward the final classification. This indicates that the model detects intrusions by identifying specific service layer patterns and traffic volume asymmetries in the backward flow, in line with the port-specific attacks (e.g., FTP/SSH brute force and web attacks) included in CIC-IDS 2017 [20]. V. C ONCLUSION The hybrid feature selection method developed in this work, combined with XAI techniques, reduces the feature space of IoMT intrusion detection models by up to 88% while keeping detection performance within a few points of full-feature baselines, yielding compact, interpretable models suited to resource-constrained healthcare environments. Beyond efficiency, the integration of SHAP and LIME provides actionable insights into the traffic characteristics driving predictions, supporting transparent and trustworthy defenses for critical healthcare infrastructure. The very high scores observed are consistent with the literature on these benchmarks in binary settings; although leakage was prevented by fitting all preprocessing on training data only, generalization to live, heterogeneous IoMT traffic remains to be assessed. Future work will investigate multiclass intrusion detection scenarios, systematic sensitivity analysis of the selection threshold, and runtime evaluation in real-time IoMT environments.
R EFERENCES [1] M. Yacoubi, O. Moussaoui, and C. Drocourt, “AI for IoMT security: a comprehensive survey of intrusion detection and system architectures,” Internet of Things, vol. 36, p. 101869, 2026. [2] L. Breiman, “Random Forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001. [3] G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y. Liu, “LightGBM: A Highly Efficient Gradient Boosting Decision Tree,” in Advances in Neural Information Processing Systems, vol. 30. Curran Associates, Inc., 2017. [4] A. Berrezzek, H. Djellali, and L. Mahnane, “A survey of intrusion detection systems in deep learning era: Methods and perspectives,” in 2025 2nd International Conference on Advances in Electronics, Control and Communication Systems (ICAECCS), Blida, Algeria, 2025, pp. 1–5. [5] E. C. P. Neto, S. Dadkhah, S. Sadeghi, H. Molyneaux, and A. A. Ghorbani, “A review of Machine Learning (ML)-based IoT security in healthcare: A dataset perspective,” Computer Communications, vol. 213, pp. 61–77, 2024. [6] S. M. Lundberg and S.-I. Lee, “A Unified Approach to Interpreting Model Predictions,” in Advances in Neural Information Processing Systems, vol. 30. Curran Associates, Inc., 2017. [7] M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should i trust you?: Explaining the predictions of any classifier,” arXiv preprint arXiv:1602.04938, 2016. [8] U. Zukaib, X. Cui, C. Zheng, M. Hassan, and Z. Shen, “Meta-IDS: Meta-Learning-Based Smart Intrusion Detection System for Internet of Medical Things (IoMT) Network,” IEEE Internet of Things Journal, vol. 11, no. 13, pp. 23 080–23 095, 2024. [9] A. Salehpour, M. A. Balafar, and A. Souri, “An optimized intrusion detection system for resource-constrained IoMT environments: enhancing security through efficient feature selection and classification,” The Journal of Supercomputing, vol. 81, p. 783, 2025. [10] G. Augusta, G. Anurekha, N. Bharathi, and A. Micheal, “A BlockchainBased Intrusion Detection System for IoMT Utilizing an Enhanced Artificial Bee Colony (E-ABC) and Deep Belief Network (DBN),” Peerto-Peer Networking and Applications, vol. 19, p. 21, 2026. [11] R. Geetha, A. Jegatheesan, R. K. Dhanaraj, K. Vijayalakshmi, A. Nayyar, V. Arulkumar, J. Velmurugan, and R. Thavasimuthu, “CVS-FLN: A Novel IoT-IDS Model Based on Metaheuristic Feature Selection and Neural Network Classification Model,” Multimedia Tools and Applications, vol. 83, pp. 86 557–86 591, 2024. [12] A. S. Abdullah, H. J. Sunil, and M. S. H. Nazmudeen, “A New Model to Evaluate Signature and Anomaly Based Intrusion Detection in Medical IoT System Using Ensemble Approach,” SN Computer Science, vol. 6, p. 347, 2025. [13] M. Kumari, N. Pramanick, M. Agarwal, and E. Esenogho, “An Optimized IDS Framework for Big Data Environments: Integrating Gravitational Search and SMOTE-IPF Data Balancing for High-Accuracy IDS,” SN Computer Science, vol. 6, p. 786, 2025. [14] H. Zeghida, M. Boulaiche, and R. Chikh, “Securing MQTT Protocol for IoT Environment Using IDS Based on Ensemble Learning,” International Journal of Information Security, vol. 22, pp. 1075–1086, 2023. [15] G. Zachos, G. Mantas, K. Porfyrakis, J. Manuel Camões Sobral de Bastos, and J. Rodriguez, “Anomaly-Based Intrusion Detection for IoMT Networks: Design, Implementation, Dataset Generation, and ML Algorithms Evaluation,” IEEE Access, vol. 13, pp. 41 994–42 028, 2025. [16] O. Arreche, I. Bibers, and M. Abdallah, “A Two-Level Ensemble Learning Framework for Enhancing Network Intrusion Detection Systems,” IEEE Access, vol. 12, pp. 83 830–83 857, 2024. [17] Z. C. Lipton, “The mythos of model interpretability,” arXiv, 2016. [18] O. Arreche, T. R. Guntur, J. W. Roberts, and M. Abdallah, “EXAI: Evaluating Black-Box Explainable AI Frameworks for Network Intrusion Detection,” IEEE Access, vol. 12, pp. 23 954–23 988, 2024. [19] S. Dadkhah, E. C. P. Neto, R. Ferreira, R. C. Molokwu, S. Sadeghi, and A. A. Ghorbani, “CICIoMT2024: A benchmark dataset for multiprotocol security assessment in IoMT,” Internet of Things, vol. 28, p. 101351, 2024. [20] Canadian Institute for Cybersecurity, “Intrusion detection evaluation dataset (cicids2017),” Online, 2017, available: https://www.unb.ca/cic/datasets/ids-2017.html.