Network security threats in embedded systems pose significant challenges to critical infrastructure protection. This paper presents a comprehensive framework combining ensemble learning methods with explainable artificial intelligence (XAI) techniques for robust anomaly detection in network traffic. We evaluate multiple machine learning models including Random Forest, Gradient Boosting, Support Vector Machines, and ensemble methods on a real-world network traffic dataset containing 19 features derived from packet-level and frequency domain characteristics. Our experimental results demonstrate that ensemble methods achieve superior performance, with Random Forest attaining 90% accuracy and an AUC of 0.617 on validation data. Furthermore, we employ SHAP (SHapley Additive exPlanations) analysis to provide interpretable insights into model predictions, revealing that packet_count_5s,inter_arrival_time, and spectral_entropy are the most influential features for anomaly detection. The integration of XAI techniques enhances model trustworthiness and facilitates deployment in security-critical embedded systems where interpretability is paramount.

翻译：嵌入式系统中的网络安全威胁对关键基础设施保护构成了重大挑战。本文提出了一种综合框架，将集成学习方法与可解释人工智能技术相结合，用于网络流量的鲁棒异常检测。我们评估了多种机器学习模型，包括随机森林、梯度提升、支持向量机及集成方法，并在一个包含19个特征的真实网络流量数据集上进行实验，这些特征源自数据包级和频域特性。实验结果表明，集成方法表现出卓越性能，其中随机森林在验证数据上达到了90%的准确率和0.617的AUC值。此外，我们采用SHAP分析提供模型预测的可解释性洞察，揭示出packet_count_5s、inter_arrival_time和spectral_entropy是异常检测中最重要的特征。可解释人工智能技术的集成增强了模型的可信度，并促进了其在可解释性至关重要的安全关键型嵌入式系统中的部署。