rCamInspector: XAI IoT Camera Detection

• rCamInspector is a machine learning and Explainable AI system for IoT camera detection that utilizes a two-stage XGB pipeline with SHAP and LIME explanations.
• It achieves high classification accuracy (92%-99%) on 38GB of network traffic by differentiating between IoT camera and other video traffic without relying on IP addresses or ports.
• The system leverages 62 flow-based features extracted with CICFlowmeter to ensure robust and reliable detection in dynamic and encrypted network environments.

Searching arXiv for the cited rCamInspector paper and closely related work on XAI for IoT traffic classification. arxiv_search: {"query":"rCamInspector Building Reliability and Trust on IoT (Spy) Camera Detection using XAI", "max_results": 5} {"query":"rCamInspector Building Reliability and Trust on IoT (Spy) Camera Detection using XAI", "max_results": 5} rCamInspector is a machine-learning and Explainable AI (XAI) system for IoT camera and IoT spy camera detection from network traffic. It is designed to address a central operational difficulty in traffic-based security analytics: high-performing classifiers often behave as black boxes, creating a roadblock to take critical decision based on the model output. The system therefore combines two traffic classifiers with SHAP and LIME explainers, and it is explicitly IP address and transport port agnostic. In the reported evaluation on 38GB of network traffic, Extreme Gradient Boosting (XGB) achieves the highest accuracy of 92% in the Flow Classifier and 99% in the SmartCam Classifier, while the accompanying explanations are assessed through consistency and sufficiency metrics (Chaudhary et al., 12 Sep 2025).

1. System definition and operational scope

rCamInspector is structured around flow-level network traffic classification rather than packet payload inspection. The input consists of network packet captures (.pcap files), collected at routers or switches with port mirroring, and the system derives flow-based features using CICFlowmeter. Up to 77 flow-based features are extracted per flow, including features such as Init Bwd Win Byts, Bwd Header Len, and Flow [IAT](https://www.emergentmind.com/topics/implicit-association-test-iat) Min. These features are not dependent on IP addresses or transport ports, which makes the system agnostic to network addressing (Chaudhary et al., 12 Sep 2025).

The design objective is not merely camera identification, but reliable and trustworthy camera identification. That distinction is central to the system’s scope. rCamInspector treats explanation as part of the detection pipeline rather than as an afterthought: SHAP and LIME are applied to analyze predictions at both classifier stages, and the paper evaluates whether the explanations are faithful to the learned model. This situates the system at the intersection of IoT traffic analysis, supervised classification, and post hoc interpretability.

A common simplification in network-security pipelines is to treat address- or port-derived signals as indispensable. rCamInspector rejects that assumption. The feature set is intentionally protocol-agnostic and address-agnostic, which the paper motivates as robustness against dynamic IP or port changes, encrypted and obscured traffic, and heterogeneous devices and networks. A plausible implication is that the system is aimed at environments in which address-based heuristics are unstable or operationally fragile.

2. Pipeline architecture and feature representation

The core architecture is a two-stage pipeline. First, a Flow Classifier categorizes a flow into one of four classes: IoTCam, Conf, Share, and Others. Second, a SmartCam Classifier operates only on flows predicted as IoTCam and classifies them into one of six camera classes: Netatmo, Spy Clock, Canary, D3D, Ezviz, and V380 Spy Bulb (Chaudhary et al., 12 Sep 2025).

Component	Input/output role	Classes
Flow Classifier	General flow categorization	IoTCam, Conf, Share, Others
SmartCam Classifier	Fine-grained IoTCam categorization	Netatmo, Spy Clock, Canary, D3D, Ezviz, V380 Spy Bulb
XAI Explainers	Explanation at both stages	SHAP, LIME

The feature extractor uses CICFlowmeter to compute flow statistics rather than identity-bearing metadata. After preprocessing, 62 of the 77 features are retained by removing highly correlated or low-variance features. The resulting representation emphasizes packet counts, byte counts, timing, window sizes, and flags. This is important because the paper’s claim to address/port agnosticism depends on the statistical sufficiency of transport-flow behavior rather than on explicit endpoint identity.

Within the first stage, the Conf class includes video conferencing traffic such as Meet, Teams, Skype, and Zoom, while the Share class includes video sharing traffic such as Youtube and Prime. This broader taxonomy matters because rCamInspector is not framed as a binary “camera vs. non-camera” detector alone. It explicitly separates IoT camera traffic from other video-heavy traffic classes that could otherwise induce confusion. In that sense, the pipeline is designed to disambiguate IoT camera behavior from conferencing and streaming behavior before attempting device-level attribution.

3. Supervised learning models and classification behavior

The paper evaluates eight supervised ML models for both classifier stages: Decision Tree (DT), k-Nearest Neighbour (kNN), Naive Bayes (NB), Logistic Regression (LR), Random Forest (RF), Extreme Gradient Boosting (XGB), Extra Tree (ET), and AdaBoost (AB). Among these, XGB is reported as the best-performing model for both tasks (Chaudhary et al., 12 Sep 2025).

For the Flow Classifier, the dataset uses an 8:2 train-test split on approximately 38GB of network traces. The paper reports that XGB attains about 92% to 93% accuracy, with precision around 93%, and an IoTCam false negative rate as low as 3.6%. For the SmartCam Classifier, trained only on IoTCam-labeled flows, XGB achieves 99.21% accuracy, 99.22% precision, 99.21% recall, and a false negative rate of 0.7%. The paper also notes that D3D, Ezviz, and V380 have per-class accuracies above 99%, while Spy Clock and Canary are somewhat lower due to class confusion.

The model-selection result is not merely a ranking of predictive accuracy. It also provides the basis for the XAI analysis, since the paper’s central interpretability claims are specifically about explaining XGB. The authors note that XGB performs well with default and tuned hyperparameters, with examples including max depth=30 and n_estimators=200. That detail indicates that the reported interpretability analysis is tied to a high-capacity tree ensemble rather than to a linear or intrinsically interpretable classifier.

A common misconception in applied XAI is that a highly accurate model is automatically operationally trustworthy. rCamInspector explicitly argues otherwise: the black-box nature of ML models remains a problem even when predictive performance is strong. The system’s contribution, as framed in the paper, is therefore the combination of competitive classification accuracy with explanation mechanisms whose faithfulness is quantified rather than assumed.

4. Explainable AI layer: SHAP, LIME, and feature attribution

The XAI layer consists of SHAP and LIME. SHAP is used to quantify feature contributions to individual predictions through Shapley values, while LIME fits an interpretable local surrogate around a prediction. The paper gives the SHAP formulation as

$$\phi_i = \sum_{S \subseteq F \setminus \{f_i\}} \frac{|S|! (|F| - |S| - 1)!}{|F|!} \left[ g(S \cup \{f_i\}) - g(S) \right]$$

and the LIME objective as

$$\hat{g} = \arg\min_{g \in G} \sum_{i=1}^{N} \pi_x(z_i) (f(z_i) - g(z_i))^2 + \Omega(g).$$

These explainers are applied to the trained XGB models for both classifier stages, providing both global and local explanations (Chaudhary et al., 12 Sep 2025).

A major empirical finding is that traditional mutual information (MI) based feature importance cannot provide enough reliability on the model output of XGB in either classifier. The paper also gives the MI expression

$$I(f_i;L_j) = \sum_{f_i,L_j} p_{(F,L)}(f_i, L_j)\log\left(\frac{p_{(F,L)}(f_i, L_j)}{p_F(f_i)p_L(L_j)}\right).$$

The argument is not that MI is useless for preliminary pruning; rather, it is insufficient as an explanation of how XGB produces specific correct predictions. This distinction is central to the paper’s reliability claim.

The feature Init Bwd Win Byts is the canonical example. It has the highest SHAP values supporting the correct prediction of both IoTCam in the Flow Classifier and Netatmo in the SmartCam Classifier. The paper also reports that SHAP identifies other influential features such as Flow IAT Min, Bwd Header Len, Pkt Len Min, and Bwd IAT Tot, depending on the class and the classifier. LIME yields overlapping but non-identical feature sets, with overlaps including Init Bwd Win Byts and Fwd Pkts/s. This divergence is presented as evidence that the two explainers are complementary rather than redundant.

This suggests a broader methodological point: global feature screening and local post hoc explanation answer different questions. MI and Pearson correlation help reduce the feature space, but SHAP and LIME are used to explain why a specific XGB prediction was made. rCamInspector’s interpretability contribution lies in keeping those roles separate.

5. Faithfulness, reliability, and empirical results

The paper evaluates explanation faithfulness using consistency and sufficiency. Consistency is measured via Spearman’s Correlation Interpretation (SCI), and sufficiency measures whether the top features explain the original model’s output. On the reported dataset, both SHAP and LIME obtain sufficiency of 1.0. For consistency, the reported values are 0.81 for SHAP and 0.74 for LIME on the Flow Classifier, and 0.71 for SHAP and 0.86 for LIME on the SmartCam Classifier. The abstract summarizes this by stating that both SHAP and LIME have a consistency of more than 0.7 and a sufficiency of 1.0 (Chaudhary et al., 12 Sep 2025).

The paper interprets these values as evidence that the explanations are stable and comprehensive enough to support reliability and trust. That is a stronger claim than merely reporting visually plausible explanations. In rCamInspector, explanation quality is itself evaluated quantitatively.

The performance results can be summarized as follows.

Classifier	Reported best XGB results	Notes
Flow Classifier	92% to 93% accuracy; about 93% precision; IoTCam false negative rate as low as 3.6%	Four-class problem
SmartCam Classifier	99.21% accuracy; 99.22% precision; 99.21% recall; 0.7% false negative rate	Six-camera problem

The abstract additionally states that, compared with existing works, rCamInspector achieves better accuracy (99%), precision (99%), and false negative rate (0.7%). The details further note that some previous work reaches high accuracy for general IoT device-type classification but often lacks explainability or uses device- or address-specific features, while XAI-driven IoT anomaly-detection work can show much lower accuracy. In that comparative framing, rCamInspector’s novelty is the joint achievement of high predictive performance, address/port agnosticism, and quantitatively assessed explanation faithfulness.

6. Interpretation, significance, and limitations

rCamInspector addresses three problems simultaneously: IP/port-agnostic detection, the black-box nature of ML traffic classifiers, and the question of which explanatory features are sufficient for a trustworthy decision. Its workflow implies that explainability is operationally useful not only for confirmation of correct classifications, but also for diagnosing misclassifications and understanding model limitations (Chaudhary et al., 12 Sep 2025).

One recurring misconception in traffic analytics is that feature importance derived from correlation or mutual information is interchangeable with explanation. The paper argues against that position directly. Another misconception is that encrypted or dynamically addressed traffic precludes accurate detection of spy cameras. rCamInspector’s use of derived flow features, rather than addresses or ports, is presented as a direct answer to that concern.

The main limitation stated in the details is the scope of the data: the analysis is focused on laboratory-collected traffic, and broader tests with more devices and public datasets are suggested for generalization. The same section notes that the set of features required for sufficient explanations may increase with more, or more diverse, device types. This suggests that the system’s explanatory stability is established for the studied taxonomy, but the explanatory basis may evolve as the class space broadens.

Within the literature on IoT traffic classification, rCamInspector is therefore best understood as a reliability-oriented detection framework rather than only as a classifier. Its technical identity lies in the coupling of a two-stage, flow-based, IP/port-agnostic XGB pipeline with SHAP and LIME explanations whose faithfulness is evaluated through consistency and sufficiency. That combination defines its contribution to IoT spy-camera detection research (Chaudhary et al., 12 Sep 2025).