## 1 Introduction
Network anomalies, such as cyber attacks, equipment failures, and unexpected traffic patterns, can have significant consequences on system performance, data integrity, and security. While numerous machine learning techniques have been employed for this purpose, challenges remain in achieving both high detection accuracy and interpretability of the results. Traditional anomaly detection methods often lack transparency, hindering the understanding of the underlying causes of detected anomalies. Furthermore, the selection of optimal classification thresholds significantly impacts performance, yet this process is frequently heuristic and lacks a principled approach [26]. This paper proposes a robust framework that combines explainable artificial intelligence (XAI) techniques and the LiNGAM for enhanced network anomaly detection. XAI provides a means to understand and explain how machine learning algorithms make decisions, which leads to a better comprehension of the essential factors that cause anomalous events [27; 28]. LiNGAM, on the other hand, is a causal inference method that can uncover the directional relationships between network variables, enabling the identification of the root causes of anomalies [29]. The TOCA-IoT model is developed to enhance the interpretability, and accuracy of network anomaly detection. Furthermore, it is utilized for enhancing network stability, reliability, security, and performance. The main contributions of this study are the following:* This study introduces a robust framework for network anomaly detection that integrates explainable artificial intelligence (XAI) with causal inference using the LiNGAM. This approach addresses the limitations of conventional anomaly detection models by enhancing both predictive accuracy and model interpretability. * The proposed framework effectively addresses common challenges in network anomaly detection. It uses the synthetic minority over-sampling technique (SMOTE) to solve class imbalance, employs a random forest classifier for robust prediction, and integrates XAI to ensure transparency and facilitate actionable insights. * The proposed TOCA-IoT model is designed to improve the accuracy, interpretability, and actionability of network anomaly detection, ultimately contributing to the improvement of network reliability, security, and performance. * The performance of the TOCA-IoT model is evaluated using the CICIoT2023 dataset, a comprehensive dataset encompassing 33 distinct attacks categorized into seven classes targeting IoT devices. This empirical validation demonstrates the framework's performance in a realistic and challenging environment. * The combination of robust random forest classifier and XAI techniques results in a more robust and transparent anomaly detection system of IoT attack datasets, increasing trust and facilitating better decision-making in real-world IoT operations. The structure of the paper is as follows: Section 2 reviews and analyzes relevant literature. Secondly, Section 3 introduces and describes the CICIoT2023 dataset. After that, Section 4 presents the TOCA-IoT model. The results analysis and discussion are presented in Section 5. Finally, the results of the experiments are summarized in Section 6, which also provides an overview of potential future work.