Causal Interpretability Methods for IoT Anomaly Traffic Detection

With the continuous development of Internet of Things (IoT) technology, an increasing number of devices are connected to the Internet, generating large amounts of high-dimensional redundant information. Moreover, significant environmental and device heterogeneity leads to nonindependent and identically distributed (N-IID) samples. These challenges compromise the stability and causal interpretability of existing IoT detection methods, limiting their effectiveness in providing actionable insights for network security defense. To address these limitations, we propose a causal interpretability-driven IoT abnormal traffic detection approach. Central to this method is the adoption of structural causal models (SCMs), which are chosen for their ability to explicitly model direct causal linkages, suppress confounding effects, ensure robust cross-deployment detection, and enable counterfactual reasoning for precise attack attribution. The approach first eliminates spurious feature associations via Fourier transformation, then constructs and prunes SCMs using causal effect analysis, KNN, and counterfactual diagnosis to restore genuine causal relationships between anomalies and traffic features. Experiments on CI-CIDS2019, ToN_IoT, and NSL-KDD datasets demonstrate effective noise reduction, redundancy elimination, and causal relationship recovery. Notably, detection accuracy improves by >19% on NSL-KDD data under polluted conditions, while maintaining stability and providing clear causal explanations for IoT network anomalies.