Fusion of TimeSHAP and Anchors: Towards Stable and Coherent Explainable Artificial Intelligence for Botnet Detection in the Internet of Things

Deep learning-based IoT botnet detection has reached high predictive performance; however, its practical deployment remains constrained by the lack of operationally actionable explainability. This paper introduces TimeAnchor, a hybrid explainability framework that integrates TimeSHAP and Anchors to enhance the temporal stability and internal consistency of explanations while preserving acceptable fidelity. The approach is evaluated on two complementary datasets: CICIDS2017, reflecting controlled and structured traffic conditions, and IoT-23, characterised by real-world, noisy, and highly heterogeneous attack scenarios. The results indicate that TimeAnchor substantially improves explanation consistency and stability across both corpora, achieving high coherence on CICIDS2017 and yielding average gains in stability and consistency on IoT-23 compared with the individual methods. These improvements are accompanied by a moderate trade-off in local fidelity, which appears acceptable given the overall enhancement in explanatory robustness. These findings support the relevance of TimeAnchor for explainable IoT botnet detection in dynamic and realistic operational environments.