Explainable Deep Reinforcement Learning for Anomaly Detection in IoT-Enabled Metaverse Healthcare: Toward Trustworthy Cyber Threat Intelligence.

The dynamic metaverse paradigm integrates emerging technologies and offers transformative opportunities to enhance consumer healthcare applications through immersive, connected experiences. However, this paradigm faces substantial cybersecurity challenges, such as distributed denial-of-service attacks, probing, and port scanning. This undermines the trustworthiness and resilience of healthcare analytics frameworks. To address these threats, intrusion detection systems that support proactive anomaly detection are essential for securing metaverse-based healthcare applications. Conventional anomaly detection techniques face challenges such as low interpretability, suboptimal feature selection, class imbalance, and inefficient hyperparameter tuning. These challenges limit their reliability in practical cyber threat intelligence settings. To solve these challenges, this paper presents an anomaly-detection framework for Internet of Things-enabled metaverse healthcare environments. The proposed framework leverages an off-policy proximal policy optimization (PPO) algorithm that incorporates SHapley Additive exPlanations-based feature selection and class-specific reward adjustments to address imbalance. The reinforcement learning-based off-policy PPO enables adaptive, sample-efficient learning by leveraging prior experience during policy updates. The hyperparameters of the model are optimized using the Bayesian Optimization Hyperband algorithm to accelerate training and enhance performance. This optimization technique combines Bayesian search with the Hyperband method to improve efficiency and convergence during model tuning. The performance of our model is evaluated on NSL-KDD, MAWI, and CICIoT2023 datasets. The results depict that the model outperformed its contemporaries with state-of-the-art results where accuracy, F-measure, G-means, and area under the curve reached 88.005%, 87.271%, 87.986%, and 0.870; 92.184%, 88.992%, 89.738%, and 0.873; and 89.368%, 88.312%, 89.039%, and 0.836, respectively. The results confirm the effectiveness of the framework in cyber threat scenarios. They also show their potential for explainable, trustworthy intelligence in metaverse healthcare.