Identification of DDoS Attacks Through SHAP-Based Feature Analysis and Transformer Models: A Multivariate Time Series Data Approach
SHAP-based feature analysis and Transformer models detect DDoS attacks in multivariate time series data with up to 99.58% F1 using 20 selected features.
Published Dec 1, 20241 citationPaper ↗
Only vote on papers you've read. Sign in to vote.
Abstract
DDoS attacks are pervasive and lead to significant economic losses because they are cost-effective and rely on readily available resources. This study introduces crucial features identified through SHAP-based analysis to capture the temporal characteristics of DDoS attacks within the Transformer model. The potential for improving online detection and classification of DDoS attacks using reduced features is evident and thoroughly discussed. The simulation results demonstrate that reducing to 20 features with selected input window sizes yields optimal performance, reaching an F1 Score of up to 99.58%. This improvement could greatly enhance real-time defense mechanisms, particularly in identifying attacks promptly when they occur in a streaming fashion.