# Embedding Security Awareness in IoT Systems: A Framework for Providing Change Impact Insights
## 3 Approach
### Local Explanation of the DNN Model and Information Extraction  
LIME (Local Interpretable Model-Agnostic Explanations) [41; 42; 43] is an XAI technique that provides local explanations for individual model predictions. In the context of DDoS detection, LIME highlights the specific attributes and their values that most influenced the model's decision for a given network traffic instance. LIME operates by perturbing the input data instance in the vicinity of its original attribute values, generating a neighborhood of synthetic samples. It then fits a sparse linear surrogate model to approximate the behavior of the complex model (in this case, our ResNet50-1D-CNN) within that local region. Each perturbed sample is weighted based on its proximity to the original instance, ensuring the surrogate model focuses on the most relevant variations. The resulting LIME explanation identifies which attributes had the most significant impact on the model's prediction, along with the specific conditions under which they influence the outcome. These insights help uncover patterns or anomalies that may indicate uncertain or suspicious behaviors potentially leading to a DDoS attack. Thus, LIME not only enhances interpretability but also contributes to a deeper understanding of the factors underlying security threats, as illustrated in Figure 2:  
* Left Side (NOT DDoS_UDP): Displays attributes that contributed to the prediction that the instance is not a DDoS_UDP attack. * Right Side (DDoS_UDP): Highlights attributes that pushed the prediction toward a DDoS_UDP classification. Each horizontal bar represents an attribute, where the length indicates the magnitude of its influence and the direction shows whether it supports or opposes the predicted class. For example, udp.stream > 0.00 (0.01): Indicates that a high volume of UDP packets (where  
Figure 2: LIME explanation for one network traffic instance. the original value is 0.73) contributes positively to a DDoS_UDP classification. This may reflect an attempt to overwhelm servers through excessive UDP traffic. While LIME provides valuable instance-level explanations, it does not fully address how these changing conditions affect the system's broader security posture. To bridge this gap, we integrate an automated interpretation generator within the _GenerateAttackStatus&ConsequenceResult_ process. This component enriches local explanations by mapping them into the system's overarching security profile, offering higher-level insights into how specific attribute variations impact both system functionality and overall risk exposure. The _GenerateAttackStatus&ConsequenceResult_ takes two primary inputs: (i) local explanations generated by LIME from DNN prediction instances, and (ii) a Security Assurance Case (SAC), which serves as the system's security profile, as illustrated in Figure 3. A parsing module, _parseExplanation_, processes each explanation and generates a set of ordered attribute-state pairs by considering the top 10 attributes, which positively contributes to the prediction, denoted as  
\[S_{exp}=\{(attr,st)\}.\]  
Here, \(attr\) refers to an attribute from the explanation, and \(st\) denotes its corresponding condition. For instance, based on the LIME explanation of a DDoS_UDP attack shown in Figure 2, _parseExplanation_ would produce the set:  
\[S_{exp}=\{(udp.stream,\ udp.stream\ >\ 0),\] \[(tcp.connection.fin,\ tcp.connection.fin=<\ 0),\] \[(tcp.ack.raw,tcp.ack.raw<=\ 0.15),\] \[(tcp.ack,\ tcp.ack<=\ 0)\}\]  
This parsing step is repeated for every prediction instance to capture the behavior patterns reflected in the explanation. The _GenerateAttackStatus&ConsequenceResult_ process also takes as input a corresponding SAC instance, which articulates security compliance arguments tied to the system's security requirements. Within this step, the _ExtractGoalAttributeRelation_ process extracts dependencies between SAC goals and system attributes.