A Resource-Efficient Explainable Deep Learning Framework for Multi-Class DDoS Attack Detection in IoT Networks

The proliferation of Internet of Things (IoT) devices has significantly expanded the attack surface for Distributed Denial-of-Service (DDoS) campaigns, demanding detection systems that are both accurate and interpretable. This paper introduces a resource-efficient explainable deep learning framework for multi-class DDoS attack detection in IoT networks, evaluated on the CICIoT۲۰۲۳ dataset across six flood-based attack subtypes (ICMP, PSHACK, RSTFIN, SYN, TCP, and UDP floods). Beyond conventional global feature-importance analysis, we propose a dual-level SHAP-based explainability pipeline that separately characterizes (i) globally important features driving overall model decisions and (ii) error-associated features that dominate SHAP contributions specifically within misclassified samples. Statistical validation using independent-samples t-tests with Benjamini-Hochberg correction and Cohen's d effect sizes confirms that misclassified samples differ significantly from correctly classified ones across nearly all statistical flow features, with large effect sizes (|d| > ۱۰) observed for volumetric descriptors such as total packet size, total sum, average, and maximum packet length. Fine-grained error-pair SHAP analysis further reveals that specific confusions, such as UDP_Flood being misclassified as RSTFINFlood, are dominated almost entirely by a single feature (Header_Length, mean |SHAP| = ۰.۵۵۹), while other confusions are driven by combinations of protocol and timing features. These findings show that the features responsible for a model's overall accuracy are frequently not the features responsible for its residual errors, motivating error-focused explainability as a necessary complement to global explainability in security-critical IoT deployments.

کلیدواژه ها:

IoT Security ، DDoS Detection ، Explainable AI ، SHAP ، Deep Learning ، CICIoT۲۰۲۳ ، Error Analysis