ST-Attention-XAI: Intrinsic Spatio-Temporal Explainability for IoT Intrusion Detection via Attention Analysis

Internet of Things (IoT) networks face advanced cyberattacks exploiting spatial and temporal patterns, whilst current intrusion detection systems offer limited insight into these attack mechanisms. The complexity of IoT traffic blurs the distinction between normal and malicious activities, leading to high false-positive rates and hindering rapid, reliable incident response. Security analysts require not just attack alerts but comprehensive answers to critical questions: which devices were compromised, what patterns were malicious, when attacks occurred, and how to respond effectively. This work introduces a trustworthy and explainable intrusion detection framework designed to deliver both accurate detection and contextual insight into the evolution of cyberattacks. Herein, IoT network flows are represented as edge-attributed graphs with temporal feature sequences, feeding into a dual attention architecture combining spatial graph attention network and temporal attention encoders to capture connectivity patterns and time-series attack dynamics. Then, a delta-attention ( \(\varDelta \) -Attn) mechanism quantifies deviations in spatial attention weights from normal behavior to extract minimal root-cause subgraphs, indicating precise attack paths and critical time windows. Temporal attention scores were further analyzed to identify critical time windows, classify attack phases, and compute behavioral feature deviations from historical patterns. Moreover, a large language model (LLM) interpretation layer is utilized to synthesize graph-based evidence into human-readable incident narratives with context-aware mitigation recommendations. Evaluation on benchmark IoT datasets (UNSW-NB15, NF-BoT-IoT-v3) demonstrates competitive detection performance (96.07% F1-weighted on UNSW-NB15, 76.32% on NF-BoT-IoT-v3), while providing faithful explanations with 34,308 \(\times \) speedup over post-hoc methods and zero additional computation beyond inference. Our framework enhances analyst trust, reduces investigation time, and enables proactive security responses in IoT environments. The implementation and code are publicly available at Github repository .