Service Interaction Profiling for Abnormal Communication Discovery in Cloud-Native Microservice Systems

Abstract

Blockchain-enabled IoT networks can improve device authentication and data integrity, but IoT gateways remain vulnerable to abnormal traffic, flooding attacks, and unauthorized access attempts. Since gateway devices often operate with limited computing resources, anomaly detection models must provide high accuracy, low latency, and clear decision explanations. This study proposes an interpretable gateway-level anomaly detection method for blockchain-enabled IoT networks based on stacking ensemble learning. The proposed framework uses Decision Tree, LightGBM, and K-Nearest Neighbors as base learners, while Logistic Regression is applied as the meta-classifier. SHAP analysis is used to interpret how gateway traffic characteristics contribute to anomaly detection results. Experiments are performed on the N-BaIoT and BoT-IoT datasets, containing 1.21 million and 2.46 million labeled traffic samples, respectively. After data cleaning and feature filtering, 35 gateway-level statistical features are used for model training, including packet count variance, connection interval, source port repetition, byte rate, and failed connection ratio. The stacking ensemble model achieves 98.74% accuracy, 98.03% F1-score, and 99.05% AUC on binary classification tasks. In multi-class attack detection, the model reaches 96.58% macro-F1 across scanning, DDoS, data exfiltration, and unauthorized access attacks. Compared with a standalone LightGBM model, the proposed method reduces false positives by 15.9% and improves recall for low-frequency attack classes by 3.46%. SHAP analysis shows that repeated short connections, abnormal outbound byte rates, and high packet count variance are strongly associated with compromised IoT gateway behavior. The results indicate that stacking-based explainable anomaly detection can strengthen the security monitoring capability of blockchain-assisted IoT gateways