## 5 Experimental Results
### Discussion  
The proposed methodology integrates multiple techniques to address various challenges in network anomaly detection. The combination of SMOTE for handling class imbalance, LiNGAM for causal inference, random forest for prediction, and XAI for interpretability is a significant strength. The use of LiNGAM for causal inference is a notable strength. Instead of simply identifying correlations, the study aims to understand the causal relationships between features and anomalies. This provides valuable insights into the underlying mechanisms of network attacks, which is crucial for effective mitigation. The incorporation of XAI techniques (SHAP values) is a major advantage. Explainable AI is increasingly important in critical applications like network security, where understanding the decision-making process of the model is critical for trust and actionability. The results presented in Section 5 demonstrate a comparison of the performance of various binary classifications. All methods demonstrated high performance after SMOTE, with accuracy exceeding 99% across the board. However, the \(F1\) score revealed differences among the approaches, with the logistic regression model showing a lower \(F1\) score of 99.69%, indicating a higher misclassification rate of the minority class (benign). Table 7 presents the results of the comparison between the TOCA-IoT framework and the state-of-the-art models. All models used the same dataset for evaluation. The results indicate that the TOCA-IoT framework outperforms several of the established models in terms of accuracy and efficiency. The TOCA-IoT model also exhibited strong performance, with perfect accuracy, precision, recall, and an F1 score of 100%. Additionally, the analysis shows that the XGB model outperformed the other models, including the Adaboost and random forest (RF) models [18]. Specifically, the XGB classifier achieved a perfect accuracy of 0.9999, along with equally high precision, recall, and \(F1\) score. This study demonstrates the efficacy of the proposed model for classifying attacks targeting IoT operations. The findings presented serve as a foundational benchmark for future ML-based cybersecurity solutions within the IoT domain. The successful application of these methods suggests the potential for exploring alternative ML algorithms, including optimized variants and adapting similar strategies to address other IoT-specific challenges. Further research could focus on a more granular analysis, investigating individual attack types or categories beyond the 33 considered here. The proposed TOCA-IoT framework can be used across diverse IoT applications, including: (1) Smart City Infrastructure: TOCA-IoT can monitor network traffic for anomalies indicative of cyberattacks targeting critical infrastructure, such as traffic light management, smart parking, and environmental sensors. The explainability features of the model are important because they can help city officials quickly understand the root cause of an anomaly and take appropriate action. The causal inference component can identify the exact object or part of the network that is affected. (2) Industrial IoT (IIoT): TOCA-IoT can monitor sensor data and network communication for anomalies indicating failures of equipment or malicious intrusion attempts. Early detection of anomalies associated with the model's explainability allows for preventative maintenance and timely security responses, minimizing downtime and potential damage. (3) Healthcare IoT: TOCA-IoT \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Classifier** & _Accuracy_ & _Precision_ & _Recall_ & _F1_ \\ \hline Adaboost [18] & 0.9958 & 0.9656 & 0.9473 & 0.9563 \\ Random Forest (RF) [18] & 0.9968 & 0.9654 & 0.9652 & 0.9653 \\ XGB & 0.9999 & 1.0 & 0.9999 & 0.9999 \\ TOCA-IoT & 1.00 & 1.00 & 1.00 & 1.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The results of the comparison between the proposed model and the state-of-the-art models.