Automated and Explainable Denial of Service Analysis for AI-Driven Intrusion Detection Systems

Fuente: arXiv
Saved in:
Bibliographic Details
Main Authors: Yakubu, Paul Badu, Santana, Lesther, Rahouti, Mohamed, Xin, Yufeng, Chehri, Abdellah, Aledhari, Mohammed
Format: Preprint
Published: 2025
Subjects:
Online Access:
Tags: Add Tag
No Tags, Be the first to tag this record!
_version_ 1866914140313878528
author Yakubu, Paul Badu
Santana, Lesther
Rahouti, Mohamed
Xin, Yufeng
Chehri, Abdellah
Aledhari, Mohammed
author_facet Yakubu, Paul Badu
Santana, Lesther
Rahouti, Mohamed
Xin, Yufeng
Chehri, Abdellah
Aledhari, Mohammed
contents With the increasing frequency and sophistication of Distributed Denial of Service (DDoS) attacks, it has become critical to develop more efficient and interpretable detection methods. Traditional detection systems often struggle with scalability and transparency, hindering real-time response and understanding of attack vectors. This paper presents an automated framework for detecting and interpreting DDoS attacks using machine learning (ML). The proposed method leverages the Tree-based Pipeline Optimization Tool (TPOT) to automate the selection and optimization of ML models and features, reducing the need for manual experimentation. SHapley Additive exPlanations (SHAP) is incorporated to enhance model interpretability, providing detailed insights into the contribution of individual features to the detection process. By combining TPOT's automated pipeline selection with SHAP interpretability, this approach improves the accuracy and transparency of DDoS detection. Experimental results demonstrate that key features such as mean backward packet length and minimum forward packet header length are critical in detecting DDoS attacks, offering a scalable and explainable cybersecurity solution.
format Preprint
id arxiv_https___arxiv_org_abs_2511_04114
institution arXiv
publishDate 2025
record_format arxiv
spellingShingle Automated and Explainable Denial of Service Analysis for AI-Driven Intrusion Detection Systems
Yakubu, Paul Badu
Santana, Lesther
Rahouti, Mohamed
Xin, Yufeng
Chehri, Abdellah
Aledhari, Mohammed
Cryptography and Security
Artificial Intelligence
Machine Learning
With the increasing frequency and sophistication of Distributed Denial of Service (DDoS) attacks, it has become critical to develop more efficient and interpretable detection methods. Traditional detection systems often struggle with scalability and transparency, hindering real-time response and understanding of attack vectors. This paper presents an automated framework for detecting and interpreting DDoS attacks using machine learning (ML). The proposed method leverages the Tree-based Pipeline Optimization Tool (TPOT) to automate the selection and optimization of ML models and features, reducing the need for manual experimentation. SHapley Additive exPlanations (SHAP) is incorporated to enhance model interpretability, providing detailed insights into the contribution of individual features to the detection process. By combining TPOT's automated pipeline selection with SHAP interpretability, this approach improves the accuracy and transparency of DDoS detection. Experimental results demonstrate that key features such as mean backward packet length and minimum forward packet header length are critical in detecting DDoS attacks, offering a scalable and explainable cybersecurity solution.
title Automated and Explainable Denial of Service Analysis for AI-Driven Intrusion Detection Systems
topic Cryptography and Security
Artificial Intelligence
Machine Learning
url https://arxiv.org/abs/2511.04114