Classification and Explanation of Distributed Denial-of-Service (DDoS)
  Attack Detection using Machine Learning and Shapley Additive Explanation
  (SHAP) Methods
Yuanyuan Wei Julian Jang-Jaccard Amardeep Singh Fariza Sabrina Seyit Camtepe
DDoS attacks involve overwhelming a target system with a large number of
requests or traffic from multiple sources, disrupting the normal traffic of a
targeted server, service, or network. Distinguishing between legitimate traffic
and malicious traffic is a challenging task. It is possible to classify
legitimate traffic and malicious traffic and analysis the network traffic by
using machine learning and deep learning techniques. However, an inter-model
explanation implemented to classify a traffic flow whether is benign or
malicious is an important investigation of the inner working theory of the
model to increase the trustworthiness of the model. Explainable Artificial
Intelligence (XAI) can explain the decision-making of the machine learning
models that can be classified and identify DDoS traffic. In this context, we
proposed a framework that can not only classify legitimate traffic and
malicious traffic of DDoS attacks but also use SHAP to explain the
decision-making of the classifier model. To address this concern, we first
adopt feature selection techniques to select the top 20 important features
based on feature importance techniques (e.g., XGB-based SHAP feature
importance). Following that, the Multi-layer Perceptron Network (MLP) part of
our proposed model uses the optimized features of the DDoS attack dataset as
inputs to classify legitimate and malicious traffic. We perform extensive
experiments with all features and selected features. The evaluation results
show that the model performance with selected features achieves above 99\%
accuracy. Finally, to provide interpretability, XAI can be adopted to explain
the model performance between the prediction results and features based on
global and local explanations by SHAP, which can better explain the results
achieved by our proposed framework.