Explainable Deep Learning for Network Attack Detection and Classification: A SHAP-Based Interpretation Framework

Abstract

There are many attacks on network such as DNS, LDAP, MSSQL, NTP, NetBIOS, PortMap, SNMP, and DDoS. Among all Distributed Denial-of-Service (DDoS) attacks are major security threats in networks. These attacks affect the availability and performance of network services. Traditional intrusion detection methods often face difficulties in identifying different types of attacks accurately. In our research paper, a framework based on an explainable deep learning is proposed to detect and predict multi-classification DDoS attacks. Here, we used the CIC-DDoS2019 dataset for experimentation. Initially, data preprocessing and feature selection are carried out using the Random Forest technique to identify important network traffic features. The selected features are then provided to a hybrid model mix of Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) model for classification. The results we achieve as accuracy of 75.39% and a weighted F1-score of 72%. SHAP analysis is applied to explain the prediction results. The tool is used to enhance the interpretability of the model. The analysis shows that Flow Bytes/s, Flow IAT Std, and Fwd Packets Length Total are the most important features for attack detection. The proposed approach provides effective classification along with better understanding of model decisions.