An Explainable Machine Learning Framework for Cyber Threat Prediction and Risk-Aware Decision Support in Information Networks

As connectivity in an IoT-equipped information network continues to grow, the exposure to various forms of cyber threats has increased, and a need now exists for predictive systems that can accurately classify and report with transparency, confidence, and risk-aware decision support. This study developed an explainable machine-learning framework for multiclass cyber-threat prediction using 222,567 labelled MQTT network-traffic observations across six classes. Logistic Regression, Random Forest, and XGBoost were evaluated using a stratified 70:30 train-test split and multiple classification metrics. The SHAP method was applied for the interpretation of the model, and probability calibration, confidence margins, risk stratification, and predictor-pattern sensitivity were analysed. XGBoost achieved the highest Macro F1 (0.6289) and Weighted F1 (0.6828) and the lowest log loss (0.7326), with an overall accuracy of 0.7188 and macro-ROC-AUC of 0.8922. Class-level discrimination was high for flood and brute force traffic. The most important predictor, as per SHAP analysis, was TCP Length. The predictive accuracy was well aligned with the expected accuracy, with an Expected Calibration Error of 0.0034, and the highest-risk predictions had an accuracy of 0.9332. The framework offers a unified framework for threat classification with interpretation, confidence assessment, and risk-driven cybersecurity decision support.