Unmasking the Unknown: Feature-Orchestrated Image Synthesis for Deep Learning-Based Threat Detection

IoT cybersecurity is crucial as a vast number of linked, susceptible devices serve as possible entry points into bigger networks. Recently, deep learning and machine learning have been used to detect both known and unknown threats. These models suffer from false positives, outdated datasets, biased evaluations against similar attacks, and an inability to generalize against unknown attacks. This study proposes Feature-Orchestrated Image Synthesis (FOS), a technique that selects key features via an explainable AI method, SHAP, then arranges them by tiling the scaled feature value across the row, and then repeats this process with each feature value to guide the image synthesis. SHAP offers a single framework that can be applied to both local and global interpretations. Benchmark datasets BoT-IoT and CICIoMT2024 were used to evaluate the models, InceptionNet and Vision Transformer (ViT). The models were trained only on Denial-of-Service attack and normal traffic images. Our proposed SHAP-ordered approach effectively prioritizes high-influence features, ensuring dependable performance and consistent detection accuracy even in complex, unbalanced network settings. Using the ViT and InceptionNet architectures, it significantly improves detection capabilities over the full features baseline across both CICIoMT2024 and BoT-IoT datasets, yielding recall improvements of 50.2% for ARP attacks and 10.8% for reconnaissance on ViT, along with a 19.0% boost in OS Fingerprint recall on InceptionNet.

@article{K2026,
  title     = {Unmasking the Unknown: Feature-Orchestrated Image Synthesis for Deep Learning-Based Threat Detection},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {17},
  number    = {9},
  year      = {2026},
  publisher = {The Science and Information Organization},
  author    = {Sruthi C K and Harini Sriraman},
  doi       = {10.14569/IJACSA.2026.0170943},
  url       = {https://doi.org/10.14569/IJACSA.2026.0170943}
}