## 2 Related Work  
There are many papers published in the area of IoT security and network anomaly detection techniques (statistical methods, rule-based systems, machine learning algorithms). The analysis of these papers offers significant insights into the present state of IoT security research and the ongoing efforts to address the challenges in this domain. These papers have provided the context for why more advanced methods, like causal inference, are needed. Many researchers have developed AI models for network intrusion detection [30, 31], anomaly detection [32], and network security [33]. The researchers have developed many deep learning models for network anomaly detection [34, 35, 36, 37]. [PERSON] et al. [38] systematically evaluate existing IoT datasets within the literature, focusing on three main objectives. Firstly, it outlines essential features of these datasets, including the nature of the testbed environment (simulated or real), the ratio of normal to attack traffic, and the diversity of IoT devices involved in data generation. Secondly, the paper classifies the datasets based on attributes such as the format, availability, number of features, and types of attacks represented. Finally, it analyzes different machine learning models utilized to tackle security challenges associated with these datasets. The study presents a total of 44 datasets sourced from multiple repositories, including digital libraries and search engines, while highlighting significant limitations such as insufficient documentation and inadequate representation of current IoT protocols and attack vectors. [PERSON] et al. [39] indicate that machine learning algorithms are increasingly effective for securing information technology (IT) systems. However, the distinct characteristics of Industrial Internet of Things (IIoT) environments necessitate a specialized performance evaluation due to their unique vulnerabilities and security requirements. This paper investigates the imperative for integrating machine learning into IIoT security mechanisms while identifying current performance deficiencies. Through a comprehensive experimental design utilizing an IIoT testbed that simulates a real industrial plant, this study aims to address the challenges and practical considerations inherent in applying machine learning for IIoT security. [PERSON] [40] demonstrates that machine learning models can substantially improve network security in IoT-based cloud computing by addressing the unique challenges posed by diverse and large-scale IoT deployments. The developed methods can analyze network traffic to detect anomalies and identify possible threats, with models such as the random forest classifier achieving 96% accuracy in attack detection. Despite their effectiveness, challenges remain in the broader adoption of machine learning for network security, necessitating further exploration of their potential and limitations to improve protective strategies in interconnected environments. Anomaly detection is essential for applications in security, healthcare, and network monitoring. [PERSON] [41] introduces FusionNet, an effective ensemble model that enhances anomaly detection accuracy by integrating multiple machine learning algorithms, including multi-layer perceptron (MLP), support vector machine (SVM), random forest (RF), and k-nearest neighbors (KNN). Evaluated on two datasets, FusionNet consistently outperformed traditional models, achieving accuracies of 98.5% and 99.5%, demonstrating its strong potential for practical use in various fields requiring precise anomaly detection. There are many papers published in the area of explainable AI (XAI) in network security. The developed methods use XAI techniques such as Shapley additive explanations (SHAPs) and local interpretable model-agnostic explanations (LIMEs) to improve the interpretability of anomaly detection models [42; 43; 44].