ML-Based Cyber Kill Chain Classification for IoT Devices in SOHO Environments

1. Introduction

The Internet of Things (IoT) has become integral to Small Office and Home Office (SOHO) environments, where devices such as smart thermostats, microphones, cameras, and voice assistants now sit alongside conventional computing equipment. Global IoT deployment exceeded 14 billion devices in 2024 and is projected to surpass 25 billion by 2030 [1], and this growth has been matched by expansion of the attack surface available to adversaries. IoT ecosystems are particularly exposed because devices vary widely in protocols and vendor standards, frequently ship with weak default credentials, receive infrequent patching and lack the processing headroom needed for conventional endpoint protection [2]. SOHO networks further compound this exposure: unlike enterprise environments, they typically lack layered defences or dedicated monitoring, making them disproportionately attractive targets. Once compromised, such devices are readily conscripted into large-scale botnets as demonstrated by the Mirai campaign that disrupted major internet services in 2016 [3].

These risks are not hypothetical. In 2024, the UK National Cyber Security Centre and international partners issued a joint advisory describing how a China state-sponsored threat group had exploited outdated, unsupported SOHO devices as a launching pad for attacks against Australian networks, precisely because such devices are easier to compromise and better able to conceal malicious traffic [4]. In 2025, threat hunters uncovered a network of over 1,000 compromised SOHO devices supporting a sustained Cyber-espionage campaign, LapDogs, affecting victims across the United States and Southeast Asia [5]. Separately, a destructive attack in 2024 disabled more than 600,000 SOHO routers, cutting Internet access for customers across 18 U.S. states [6]. Collectively, these incidents illustrate that SOHO IoT compromises carry consequences well beyond the individual household or business, extending into regional connectivity, critical services and international security.

Machine learning (ML) techniques have emerged as a promising alternative to signature- and rule-based Intrusion Detection Systems (IDSs), offering the ability to detect anomalous or novel traffic patterns without relying on known attack signatures [7]. Numerous studies have applied ML algorithms to IoT intrusion detection with strong results, including on the CICIoT2023 dataset used in this study (see Section 2). However, the overwhelming majority of this work stops at classifying traffic as benign or as one of several attack types. This leaves a practically important gap: Knowing that traffic is malicious does not, by itself, indicate where in an attack’s lifecycle a defender is intervening, information that is critical for prioritising response. The Cyber Kill Chain (CKC) framework [8], which decomposes an attack into sequential stages from reconnaissance through actions on objectives, offers a natural structure for this kind of stage-aware contextualisation. Yet, its application to IoT-specific traffic and to SOHO environments in particular remains largely unexplored [9].

1.1. Research Objectives and Contribution

This study addresses the above gap by developing a two-phase ML-based IDS for SOHO IoT traffic that (i) detects and classifies intrusions using the CICIoT2023 six-class dataset [10], and (ii) extends detection into CKC stage classification, supported by SHAP-based explainability to keep the resulting model’s decisions interpretable for defenders. In doing so, the study makes three contributions:

• It provides a comparative evaluation of Random Forest, Decision Tree, and LightGBM for IoT intrusion detection on a class-balanced version of CICIoT2023,
• It operationalises, to the best of the our knowledge for the first time on IoT-specific traffic, a machine learning classifier that maps detected intrusions onto CKC stages. And finally,
• It applies feature importance and SHAP analysis to identify which traffic characteristics drive stage-level classification decisions, offering interpretable insight for both researchers and practitioners.

1.2. Structure of the Paper

The rest of the paper is structured as follows. In Section 2, we review some of the state-of-the-art literature most relevant to our paper. In Section 3, we give details the dataset, preprocessing and modelling methodology. In Section 4, we report the intrusion detection and CKC stage classification results, together with the feature importance and SHAP analysis. In Section 5, we interpret these results in light of the existing literature and consider their theoretical, practical and policy relevance. Finally, in Section 6, we conclude the paper summarising the study’s limitations and directions for future work.

2. Related Work

Cybersecurity research has long emphasised robust attack detection, and while SOHO environments attract less attention than higher-stakes sectors such as healthcare or critical infrastructure, the incidents outlined in Section 1 show that the consequences of SOHO compromise are far from trivial. Because SOHO-specific ML-IDS research remains limited, this review draws on three related bodies of work: studies using the CICIoT2023 dataset [10] specifically, broader ML-based IoT security research using other datasets and finally, prior work applying machine learning to CKC classification.

2.1. Machine Learning-Based Intrusion Detection Using CICIoT2023

Several studies have used CICIoT2023 to build IoT-specific intrusion detection models. For example, in [11] the authors combine two-step data clustering with a Multilayer Perceptron to manage the dataset’s high dimensionality, achieving 97.26% binary-classification accuracy. In [12], the authors applied hierarchical feature selection to reduce the feature space to 23 variables before training a CatBoost classifier, achieving 99.4% accuracy, precision, recall and F1-score across DoS, DDoS and Mirai subtypes with SHAP used to interpret feature contributions, an approach this study extends to CKC stage classification. In [13], a comparison among five classifiers was given under binary, grouped and fine-grained labelling schemes, with Decision Tree and Random Forest achieving near-100% accuracy and substantially outperforming SVM, which are results consistent with the Phase 1 results we report in Section 4.1. In [14], the authors proposed a stacking ensemble (Random Forest and Linear SVM base learners with a Logistic Regression meta-model) combined with SMOTE for class balancing, achieving 93% accuracy, though with reduced precision (85%) for reconnaissance traffic due to feature overlap. This challenge echoes the late-stage mis-classification pattern observed for exploitation and command-and-control traffic in our work. In [10], which also introduced the CICIoT2023 dataset, the authros reported 99.7% and 99.4% binary-classification accuracy for Random Forest and Deep Neural Networks respectively, but noted a marked drop in F1-score (approximately 71%) once classification was extended to the dataset’s full 34-class taxonomy, illustrating the general trade-off between classification granularity and accuracy that recurs across this literature.

2.2. Broader Machine Learning-Based IoT Security Techniques

Beyond CICIoT2023 [10], a wider body of work has evaluated ML and deep learning models for IoT and industrial IoT (IIoT) intrusion detection. For example, [15] compared XGBoost, SVM and deep convolutional neural networks across IoT-23, NSL-KDD, TON_IoT and a custom testbed, finding that XGBoost achieved the best accuracy (99.98%) while training substantially faster than the alternatives, which is an efficiency argument one can use relevantly to resource-constrained SOHO deployment. In [16], the authors proposed a dual-layer LSTM architecture with cryptography-integrated alerting, achieving 98% accuracy on UNSW-NB15, while in [17], the authors found Random Forest outperforming SVM and XGBoost for both binary (92.73%) and multiclass (82.67%) classification on the same dataset, with multiclass accuracy degrading for rare attack types. This again mirrors the exploitation and command-and-control weaknesses observed in our CKC results. In [18], an evaluation of ensemble techniques was provided within a fog-computing architecture across UNSW-NB15 and CICIDS2017, which found that stacking outperformed individual classifiers, including Random Forest though at the cost of increased model complexity and training time. In [19], the authors reported that deep learning architectures (Bi-LSTM, GRU) achieved near-perfect accuracy (99.99%) on an Industrial IoT dataset, outperforming classical ML methods but at considerably higher computational cost up to 1,207 seconds for multiclass Bi-LSTM training. In [20], ensemble ML was combined with software-defined networking and network function virtualisation to deliver 99.9% accuracy with a 0.1% false-positive rates, demonstrating that ML-based detection can be embedded within broader automated network defence architectures. Across this literature, tree-based ensembles consistently perform competitively with, and are often more efficient than, deep learning alternatives thus supporting the choice of Random Forest, Decision Tree and LightGBM as the Phase 1 classifiers in our study.

2.3. Machine Learning-Based Cyber Kill Chain Classification

Literature explicitly combining machine learning with Cyber Kill Chain classification is scarce. The most directly relevant study is [21], which proposes an ML framework for mapping security alerts to the seven canonical CKC stages in the context of Advanced Persistent Threats (APTs). Using Multiple Factor Analysis for feature extraction and OneR/InfoGain for feature selection, they found that Naive Bayes achieved 91.1% accuracy using only five optimised features, outperforming SVM and Random Forest on a dataset of 3,676 observations. While this confirms the general feasibility of combining CKC classification with machine learning, the work targets APT alerts rather than IoT network traffic. There are no CKC-aware classifiers proposed and trained specifically on IoT traffic, and certainly none for SOHO-relevant datasets such as CICIoT2023.

2.4. Summary and Research Gap

Table 1 summarises the reviewed literature against three criteria: use of the CICIoT2023 dataset, application of ML to IoT security, and inclusion of CKC-stage classification. No reviewed study satisfies all three simultaneously: studies using CICIoT2023 achieve strong detection performance but stop at attack-type classification (Section 2.1), while the one study to attempt CKC classification does so on non-IoT data (Section 2.3). This gap motivated the present study.

3. Methodology

This study followed a two-phase quantitative research design. Phase 1 developed and compared three supervised classifiers for intrusion detection in IoT network traffic. Phase 2 extended the detected intrusions into CKC stage classification using the best-suited classifier from Phase 1, supported by feature importance and SHAP-based explainability analysis. Both phases used the CICIoT2023 six-class dataset as their common foundation. All experiments were implemented in Python 3.13.2 using pandas, NumPy, scikit-learn, LightGBM, matplotlib, seaborn and SHAP. Figure 1 summarises the overall research methodology.

3.1. Dataset Description

The CICIoT2023 six-class dataset [10], developed by the Canadian Institute for Cybersecurity, was used for both phases of this study. It is a reduced, class-balanced derivative of the original CICIoT2023 dataset (45,807,617 instances across eight classes), retaining 1,800,000 network traffic instances distributed approximately evenly across six classes (benign traffic and five attack categories: DDoS, DoS, reconnaissance, Mirai and Web-based attacks). The dataset was selected in preference to conventional intrusion-detection benchmarks such as NSL-KDD [22] and UNSW-NB15 [23] because it was collected specifically from IoT traffic and captures attack types characteristic of consumer and SOHO device compromise. It was obtained as a single CSV file (df_FL_CICIoT2023_6_classes.csv, ≈ 1.2 GB uncompressed) from a public Zenodo repository, with file integrity confirmed against the repository’s published MD5 checksum prior to use.

Each instance is described by 17 fields: 16 numerical traffic features (flow duration, header length, protocol type, packet/byte rates, TCP flag counts, packet-size statistics, inter-arrival time, magnitude and variance) and one categorical label, sub_label, encoding benign traffic and five attack categories as shown in Table 2.

Because the dataset’s class balance was confirmed to be near-uniform (each class ≈ 16.67% of instances), the full dataset was used without additional sampling in either phase. Table 3 describes each of these 16 numerical features in turn. Because the dataset’s class balance was confirmed to be near-uniform (each class ≈ 16.67% of instances), the full dataset was used without additional sampling in either phase.

3.2. Data Preprocessing

A common preprocessing pipeline was applied in both phases: a dropna() check for missing values (none were found), verification of dataset integrity and structure (via info() and describe()), and an 80/20 stratified train–test split ($\mathit{stratify}=y$, $\mathit{random}\_\mathit{state}=42$) to preserve class balance across partitions. This yielded 1,440,000 training and 360,000 test instances, with 60,000 test instances per class.

For Phase 1, the sub_label column was retained as the multiclass target (benign vs. five attack types) without further transformation, and all 16 numerical features were used as model inputs. For Phase 2, sub_label was additionally mapped onto four stages of the CKC, producing a new target column, Kill_Chain_Stage. Benign traffic was retained as a non-attack baseline class rather than mapped onto the kill chain. Table 4 summarises this mapping and its rationale.

3.3. Exploratory Data Analysis

3.3.1. Dataset Structure and Feature Distributions

The info() and describe() outputs (Figure 2 and Figure 3) confirmed 1,800,000 complete records with 16 float64 features and one int64 label, requiring no categorical encoding. Table 5 summarises the central tendency and dispersion of key features. Several features exhibited strongly right-skewed distributions with long tails, notably Rate, Srate, and flow_duration, consistent with a small number of high-intensity flooding events (DoS/DDoS) amid a much larger volume of low-rate benign and reconnaissance traffic.

3.3.2. Feature Correlation Analysis

A clustered correlation heatmap of the twenty most influential features (Figure 4) was used to assess redundancy prior to modelling. Three clusters emerged.

A $size/magnitude$ cluster (Magnitude, AVG, Tot sum, Tot size, Max, Min) showed strong mutual correlation (r ≈ 0.60–0.96), reflecting shared measurement of packet-size volume. A header/flag cluster (Header_Length, rst_count, urg_count) showed moderate-to-strong correlation (r ≈ 0.63–0.87), associated with header structure and control-flag behaviour. A third, low-correlation behavioural group (Rate, Srate, IAT, flow_duration, Protocol Type, Variance, syn_count) showed weak correlation both within the group and with the other clusters (|r| < 0.25), indicating these features capture distinct, complementary timing- and state-based traffic behaviour. Because tree-based ensembles such as Random Forest, Decision Tree, and LightGBM are largely insensitive to multicollinearity, all 16 features were retained for model training rather than removed or combined.

3.3.3. Class Distribution

The value_counts(normalize = True) method confirmed a near-uniform class distribution, with each of the six classes representing approximately 16.67% of the full dataset (≈ 300,000 instances per class), preserved as 60,000 instances per class in the stratified test split (Figure 5). This balance removes class-imbalance bias as a confounding factor in the evaluation of Phase 1 and Phase 2 classifiers.

3.4. Model Implementation

Phase 1 compared three classifiers commonly used in IDS research for their robustness on high-dimensional network traffic data: Random Forest, Decision Tree, and LightGBM. Each was trained with the hyperparameters in Table 6, using the 80% training partition (1,440,000 instances) and all 16 numerical features as input, with sub_label as the target. Phase 2 re-used LightGBM, retrained on the same feature set against the Kill_Chain_Stage target derived in Section 3.2, to classify detected traffic into CKC stages.

3.5. Evaluation Metrics

Model performance was assessed on the held-out 20% test partition using accuracy, precision, recall, and F1-score, computed per class via scikit-learn’s classification_report, together with confusion matrices for error analysis. For a given class, true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN) were defined in the conventional one-vs-rest sense. The metrics were computed as:

$$\mathit{Accuracy}={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

$$\mathit{Precision}={\displaystyle \frac{TP}{TP+FP}}$$

$$\mathit{Recall}={\displaystyle \frac{TP}{TP+FN}}$$

$$\mathit{F}\mathit{1}={\displaystyle \frac{2\times \mathit{Precision}\times \mathit{Recall}}{\mathit{Precision}+\mathit{Recall}}}$$

These follow standard definitions: recall ([24]), precision ([25]), and F1-score ([26]). To interpret the drivers of Phase 2 classification decisions, split-gain feature importance and SHAP (SHapley Additive exPlanations) analysis were applied to the trained LightGBM CKC classifier, quantifying each feature’s marginal contribution to individual predictions and revealing interaction effects between features.

4. Results

4.1. Intrusion Detection Performance (Phase 1)

Random Forest achieved the highest overall accuracy (99.86%), followed by Decision Tree (99.74%) and LightGBM (95.00%). Table 7 reports per-class precision, recall, and F1-score for all three classifiers. Random Forest and Decision Tree achieved near-perfect scores across all six classes; LightGBM matched this performance for DDoS, DoS, and reconnaissance traffic but showed a measurable drop for benign, Mirai, and web-attack traffic (F1 = 0.91 for each), indicating greater difficulty separating these classes.

4.2. Cyber Kill Chain Stage Classification (Phase 2)

The LightGBM CKC classifier achieved perfect precision, recall, and F1-scores (1.00) for the reconnaissance and delivery stages (DDoS and DoS traffic). Performance was comparatively lower for the exploitation stage (web attacks; precision 0.93, recall 0.89, F1 0.91) and the command-and-control stage (Mirai; precision 0.91, recall 0.91, F1 0.91), with benign traffic showing the same reduced scores (precision 0.89, recall 0.93, F1 0.91) as in Phase 1 (Table 8).

The confusion matrix (Figure 6) shows strong diagonal dominance overall, confirming reliable separation of benign, reconnaissance, and delivery-stage traffic. Misclassification was concentrated between the exploitation and command-and-control stages, and between each of these and benign traffic, indicating that late-stage attack behaviours are harder to separate from normal communication patterns than early- and mid-stage behaviours such as scanning or flooding.

4.3. Model Explainability: Feature Importance and SHAP Analysis

Feature importance (split gain) and SHAP analysis were used to interpret the LightGBM CKC classifier’s predictions (Figure 7 and Figure 8). Table 9 summarises the ten most influential features. Inter-arrival time (IAT) was the dominant feature overall, consistent with its role in distinguishing timing-based attack signatures such as the sustained, high-rate flows characteristic of DDoS traffic. Header length and flow duration were the next most influential, followed by packet rate and urgent-flag counts.

SHAP interaction values corroborated these rankings: flow_duration and syn_count showed the widest interaction spread, particularly in combination with Rate and Protocol Type, explaining the classifier’s near-perfect performance on delivery-stage (DDoS/DoS) and reconnaissance traffic. Interaction effects involving Srate were comparatively weak in isolation but contributed to prediction confidence when combined with Rate and flow_duration, illustrating that low standalone importance does not preclude a meaningful interactive role. The features driving misclassification between benign, exploitation, and command-and-control traffic (chiefly Header_Length and flow_duration) were the same features with only moderate standalone importance, consistent with the subtler behavioural signatures of late-stage attacks noted in Section 4.2.

5. Discussion

5.1. Interpretation of Intrusion Detection Findings

The superior performance of Random Forest and Decision Tree over LightGBM is consistent with prior evaluations of tree-based classifiers on CICIoT2023: [13] similarly found RF and DT outperforming SVM and logistic regression, while [10] reported 99.7% accuracy for RF in binary IoT intrusion detection. The comparatively lower accuracy of LightGBM is plausibly explained by the balanced nature of the dataset used here: boosting methods such as LightGBM typically derive their advantage from focusing learning capacity on under-represented classes, an advantage that is largely neutralised when classes are already near-uniform in size ([27]). This is consistent with [14] observation that LightGBM, while computationally efficient, is more prone to misclassifying traffic in complex multiclass IoT settings than ensemble methods that aggregate multiple tree outputs. In this study, LightGBM’s precision and recall losses were concentrated in benign, Mirai, and web-attack traffic, the same three classes it struggled to separate in the CKC stage classification task (Section 4.2), suggesting a consistent, feature-level source of ambiguity across both phases rather than a phase-specific artefact.

Taken together, these results position Random Forest as the preferred classifier where detection accuracy is the priority, while LightGBM’s markedly lower training and inference cost may still justify its use in SOHO deployments where computational resources are severely constrained ([27]).

5.2. Interpretation of Cyber Kill Chain Classification Findings

Extending detection into CKC stage classification produced near-perfect results for reconnaissance and delivery-stage traffic but weaker performance for exploitation and command-and-control traffic. This gradient mirrors a recurring finding in the literature: late-stage attack behaviours often exhibit subtler signatures that more closely resemble legitimate traffic than early- or mid-stage behaviours such as scanning or flooding ([12]). Mirai command-and-control traffic, for example, typically consists of short, periodic keep-alive packets that can resemble legitimate IoT telemetry ([3]), while web-exploitation traffic (e.g., SQL injection, XSS) can initially resemble ordinary HTTP activity, plausibly explaining the partial misclassification of both stages as benign observed in Section 4.2.

Despite these late-stage challenges, the classifier demonstrates that CKC stage mapping is both feasible and useful within IoT traffic. Distinguishing reconnaissance from delivery, exploitation, and command-and-control activity provides defenders with lifecycle-aware context beyond a binary malicious/benign flag, potentially enabling earlier intervention, for example, blocking traffic at the reconnaissance stage, or disrupting persistence by identifying command-and-control channels. This capability is comparatively novel: while [21] demonstrated CKC-stage mapping using machine learning, their work targeted advanced persistent threats (APTs) rather than IoT traffic, and no directly comparable IoT-specific CKC classifier trained on CICIoT2023 was identified in the reviewed literature.

5.3. Explainability Insights

The integration of SHAP alongside split-gain feature importance served two purposes: clarifying why individual flows were assigned to a given CKC stage, and surfacing which traffic characteristics are most diagnostic of attack-stage behaviour. The consistent prominence of IAT, flow_duration, and Rate across both importance measures (Section 4.3) aligns with [12] finding that TCP flag counts and protocol-level features were critical in distinguishing DDoS subtypes on the same dataset, and reinforces the broader case for timing-based monitoring as an early-warning signal in SOHO deployments. At the same time, features with low standalone importance but meaningful interaction effects (notably Srate) illustrate a limitation of relying on importance rankings alone: some diagnostic signal is only visible through feature interactions, which are more costly to compute and less intuitive for non-specialist defenders to interpret, an issue also raised in the wider explainable-AI-for-cybersecurity literature ([28]).

5.4. Comparison with Related Literature

The Phase 1 results compare favourably with published work on CICIoT2023. [11] reported 97.26% binary and 96.26% multiclass accuracy using a multilayer perceptron; the 99.86% multiclass accuracy achieved here by Random Forest indicates a clear advantage for tree-based ensembles on this dataset. [12] achieved 99.4% accuracy for DoS/DDoS subtypes using CatBoost, closely matching the perfect scores obtained here for the same categories, though without extending to CKC classification. [13] similarly reported near-100% accuracy for Decision Tree and Random Forest on grouped attack categories, consistent with the Phase 1 findings. Beyond CICIoT2023, comparable accuracies have been reported on other IoT and network intrusion datasets, for example [15] with XGBoost on IoT-23/NSL-KDD (99.98%) and [19] with Bi-LSTM on ToN-IoT (99.99%), though generally without the SOHO-specific framing or CKC extension pursued in this study (Figure 9 and Figure 10).

For CKC-specific classification, the closest comparator remains [21], whose APT-focused Naive Bayes classifier achieved 91.1% accuracy. The 95% accuracy achieved here on IoT traffic, combined with the absence of a directly comparable IoT-specific CKC classifier in the reviewed literature, positions this study as an early contribution to operationalising kill-chain-aware detection specifically for IoT and SOHO contexts, an area explicitly identified as under-researched by [9].

5.5. Theoretical, Practical, and Policy Implications

Theoretically, this study extends IoT IDS research beyond binary or multiclass attack detection toward stage-aware classification, responding to calls for kill-chain-informed detection frameworks [9], and contributes one of the first applications of SHAP to CKC stage classification specifically within IoT traffic, identifying IAT, flow duration, and packet rate as the traffic dimensions most diagnostic of attack-stage progression.

Practically, the high accuracy achieved by Random Forest and Decision Tree (>99%) indicates that reliable detection can be deployed on hardware suitable for consumer-grade SOHO routers, while stage-aware classification enables more differentiated incident response, for example, escalating alerts differently depending on whether traffic reflects reconnaissance or active command-and-control activity.

At a policy level, the findings support arguments for embedding baseline detection capability into consumer IoT devices and SOHO routers. This is consistent with warnings from the UK National Cyber Security Centre regarding the systematic exploitation of SOHO devices ([4] and with existing consumer-IoT security guidance such as the UK Code of Practice for Consumer IoT Security ([29]). Evidence that ML-based, stage-aware IDS can be both accurate and computationally lightweight strengthens the case for mandating at least reconnaissance- and delivery-stage detection capability in internet service provider or device-manufacturer security requirements, given the continued exploitation of SOHO devices in large-scale botnet campaigns ([5]).

5.6. Strengths and Limitations

We can summarise the strengths of our study as follows:

• A novel application of CKC stage classification to IoT traffic, an area with very limited prior coverage in the CICIoT2023 literature.
• Use of a class-balanced dataset, mitigating imbalance effects that commonly undermine IDS evaluation.
• Integration of SHAP-based explainability, supporting transparency and trust in the classifier’s decisions.
• Explicit framing around SOHO environments, a segment often overlooked relative to enterprise or industrial IoT security research.

Several limitations should be considered when interpreting these findings:

• CICIoT2023 was collected in a controlled testbed; real-world SOHO traffic may exhibit greater noise and device heterogeneity, limiting generalisability.
• Only four of the seven canonical CKC stages (reconnaissance, delivery, exploitation, command-and-control) were represented, owing to constraints in the underlying dataset labels.
• Deep learning architectures (e.g., LSTM, CNN) were not evaluated, despite reported state-of-the-art results for such models in related IDS work.
• SHAP analysis, while informative, remains computationally intensive and non-trivial to interpret for non-specialist practitioners.
• Random Forest, the most accurate classifier, carries a larger resource footprint than Decision Tree or LightGBM, which may constrain deployment on the lowest-power SOHO hardware.

6. Conclusion

This study developed and evaluated a two-phase, ML-based intrusion detection system for SOHO IoT traffic that extends conventional attack classification into Cyber Kill Chain stage classification, supported by explainable AI. Using the CICIoT2023 six-class dataset, Random Forest and Decision Tree achieved detection accuracies above 99%, while LightGBM offered a favourable accuracy–efficiency trade-off (95%) suited to resource-constrained deployment. Extending detection with a LightGBM-based CKC classifier achieved near-perfect performance for reconnaissance and delivery-stage traffic and robust, though comparatively weaker, performance for exploitation and command-and-control traffic, with SHAP and feature-importance analysis identifying inter-arrival time, flow duration, and packet rate as the dominant drivers of stage classification. The study contributes academically by demonstrating, for IoT traffic specifically, that stage-aware intrusion classification is both feasible and explainable, addressing a gap between conventional binary/multiclass IDS research and kill-chain-informed defence frameworks. Practically, it shows that high-accuracy detection and stage classification can be achieved with models suited to commodity SOHO hardware, while the SHAP-based analysis offers defenders interpretable insight into which traffic characteristics distinguish each stage of an attack. At a policy level, the findings add empirical support to calls for embedding baseline, stage-aware detection capability into consumer IoT devices and SOHO routers. These contributions should be read alongside the limitations discussed in Section 5.6, particularly the controlled-environment origin of the dataset and the restricted coverage of CKC stages. Future work should prioritise: (i) validating the approach on real-world or noisier SOHO traffic; (ii) extending CKC coverage to additional stages, through synthetic data generation or supplementary datasets; (iii) evaluating deep learning architectures (e.g., LSTM, GRU, CNN) for their capacity to resolve the late-stage classification challenges identified here; (iv) exploring federated or edge-based training to address data-privacy constraints in SOHO settings; (v) combining signature-based and ML-based detection for improved robustness; and (vi) simplifying SHAP-based outputs into forms that are directly actionable for non-specialist practitioners.