[Paper Review] Classification and Explanation of Distributed Denial-of-Service (DDoS) Attack Detection using Machine Learning and Shapley Additive Explanation (SHAP) Methods

Yuanyuan Wei, Julian Jang‐Jaccard+3 more|arXiv (Cornell University)|Jun 27, 2023

Network Security and Intrusion Detection4 citations

TL;DR

This paper proposes a machine learning framework combining feature selection and explainable AI to detect DDoS attacks with high accuracy and interpretability. Using SHAP explanations on an MLP classifier trained on top 20 features from the CICDDoS2019 dataset, the model achieves over 99% accuracy in both one-to-one and one-to-all classification scenarios, with SHAP providing global and local interpretability of feature contributions to predictions.

ABSTRACT

DDoS attacks involve overwhelming a target system with a large number of requests or traffic from multiple sources, disrupting the normal traffic of a targeted server, service, or network. Distinguishing between legitimate traffic and malicious traffic is a challenging task. It is possible to classify legitimate traffic and malicious traffic and analysis the network traffic by using machine learning and deep learning techniques. However, an inter-model explanation implemented to classify a traffic flow whether is benign or malicious is an important investigation of the inner working theory of the model to increase the trustworthiness of the model. Explainable Artificial Intelligence (XAI) can explain the decision-making of the machine learning models that can be classified and identify DDoS traffic. In this context, we proposed a framework that can not only classify legitimate traffic and malicious traffic of DDoS attacks but also use SHAP to explain the decision-making of the classifier model. To address this concern, we first adopt feature selection techniques to select the top 20 important features based on feature importance techniques (e.g., XGB-based SHAP feature importance). Following that, the Multi-layer Perceptron Network (MLP) part of our proposed model uses the optimized features of the DDoS attack dataset as inputs to classify legitimate and malicious traffic. We perform extensive experiments with all features and selected features. The evaluation results show that the model performance with selected features achieves above 99\% accuracy. Finally, to provide interpretability, XAI can be adopted to explain the model performance between the prediction results and features based on global and local explanations by SHAP, which can better explain the results achieved by our proposed framework.

Motivation & Objective

• To address the challenge of detecting DDoS attacks with high accuracy while ensuring model interpretability for security experts.
• To reduce model complexity and improve performance by selecting the most relevant features using multiple feature importance techniques.
• To provide transparent, human-understandable explanations of model predictions using SHAP for both global and local interpretability.
• To evaluate the framework in both one-to-one (benign vs. one attack type) and one-to-all (benign vs. multiple attack types) classification scenarios.
• To demonstrate that explainable AI can enhance trust in black-box models for cybersecurity applications.

Proposed method

• Feature selection using three XGBoost-based importance techniques: XGB-based feature importance, permutation feature importance, and SHAP feature importance.
• Selection of the top 20 most influential features from the CICDDoS2019 dataset to form an optimized feature subset.
• Training a Multi-layer Perceptron (MLP) classifier on the optimized feature subset for binary classification of benign and malicious traffic.
• Evaluation of model performance in two scenarios: one-to-one (benign vs. one attack type) and one-to-all (benign vs. multiple DDoS attack types).
• Application of Kernel SHAP for global and local explanation of model predictions, visualizing feature contributions to classification outcomes.
• Use of force plots to interpret individual predictions, showing which features push predictions toward benign (1.00) or malicious (0.00) classes.

Experimental results

Research questions

• RQ1 Can a machine learning model achieve over 99% accuracy in classifying DDoS attacks using only the top 20 most important features from the CICDDoS2019 dataset?
• RQ2 How do different feature importance techniques (XGBoost, permutation, SHAP) compare in identifying relevant features for DDoS detection?
• RQ3 To what extent can SHAP provide meaningful local and global explanations of the MLP classifier’s predictions for DDoS traffic?
• RQ4 What are the key features that most influence the model’s decision to classify traffic as benign or malicious?
• RQ5 Can the combination of feature selection and SHAP explainability improve trust in black-box DDoS detection models?

Key findings

• The MLP classifier achieved over 99% accuracy in both one-to-one and one-to-all classification scenarios when trained on the top 20 selected features.
• The feature 'Inbound' consistently emerged as a top contributor, with values of 0 or 1 significantly influencing predictions toward benign or malicious classes.
• SHAP-based local explanations clearly identified misclassified instances, such as benign traffic being misclassified as malicious due to high contributions from features like 'Inbound' (0) and 'Min Packet Length' (0).
• Global SHAP explanations ranked features in decreasing order of importance, with 'Min Packet Length', 'Fwd Packet Length Min', and 'Inbound' being among the most influential.
• Force plots effectively visualized the impact of individual features on prediction outcomes, showing both positive (red) and negative (blue) contributions toward benign or malicious labels.
• The framework successfully demonstrated that high-accuracy DDoS detection can be achieved with a reduced feature set while maintaining full interpretability through SHAP.