Digital Twin

Machine-learning intrusion detectors usually report predictive performance but do not specify how a detected IoT attack should be handled when response actions have different operational costs. This paper presents CARE-GATE, a cost-aware response policy that combines detector confidence, explanation stability, and a Digital Twin state residual in an uncertainty gate. The gate blocks automatic isolation when evidence is uncertain and uses an explicit cost matrix to calibrate its weights and threshold. Evaluated on a balanced eight-class subset of CICIoT2023, CatBoost gives the best weighted F1-score (76.09%). These results show how explicit operational costs and uncertainty evidence shape response behavior beyond detector accuracy alone.

Keywords: Internet of Things · intrusion detection · cost-sensitive response · uncertainty gating · Digital Twin · explainable AI · SHAP · CatBoost

Internet of Things (IoT) intrusion detectors often report high accuracy yet still fail at the operational response stage, where uncertain predictions can cause false isolation or delayed mitigation. This paper presents CXG-DT, a confidence- and explanation-gated Digital Twin (DT) response framework for IoT intrusion handling. The pipeline detects attacks with lightweight models, estimates calibrated confidence, computes selective SHAP only when a risk gate opens, validates alerts against virtual device twin states, and permits monitor, throttle, isolate, or escalate actions only when an uncertainty score is acceptable. On a locked multiclass IoT evaluation, CatBoost attains the best detection trade-off with 81.94% accuracy and 82.01% weighted F1-score. CXG-DT therefore shifts IoT IDS evaluation from accuracy alone toward safe closed-loop response under uncertainty.

Keywords: IoT intrusion detection · Digital Twin · explainable AI · SHAP · edge AI · uncertainty gating · CatBoost