Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Explainability-Aware Evaluation of Transfer Learning Models for IoT DDoS Detection Under Resource Constraints

Nelly Elsayed

TL;DR

Results indicate that DenseNet and MobileNet-based architectures achieve strong detection performance while demonstrating superior reliability and compact, class-consistent attribution patterns, and the importance of combining performance, reliability, and explainability criteria when selecting deep learning models for IoT DDoS detection.

Abstract

Distributed denial-of-service (DDoS) attacks threaten the availability of Internet of Things (IoT) infrastructures, particularly under resource-constrained deployment conditions. Although transfer learning models have shown promising detection accuracy, their reliability, computational feasibility, and interpretability in operational environments remain insufficiently explored. This study presents an explainability-aware empirical evaluation of seven pre-trained convolutional neural network architectures for multi-class IoT DDoS detection using the CICDDoS2019 dataset and an image-based traffic representation. The analysis integrates performance metrics, reliability-oriented statistics (MCC, Youden Index, confidence intervals), latency and training cost assessment, and interpretability evaluation using Grad-CAM and SHAP. Results indicate that DenseNet and MobileNet-based architectures achieve strong detection performance while demonstrating superior reliability and compact, class-consistent attribution patterns. DenseNet169 offers the strongest reliability and interpretability alignment, whereas MobileNetV3 provides an effective latency-accuracy trade-off for fog-level deployment. The findings emphasize the importance of combining performance, reliability, and explainability criteria when selecting deep learning models for IoT DDoS detection.

Explainability-Aware Evaluation of Transfer Learning Models for IoT DDoS Detection Under Resource Constraints

TL;DR

Results indicate that DenseNet and MobileNet-based architectures achieve strong detection performance while demonstrating superior reliability and compact, class-consistent attribution patterns, and the importance of combining performance, reliability, and explainability criteria when selecting deep learning models for IoT DDoS detection.

Abstract

Distributed denial-of-service (DDoS) attacks threaten the availability of Internet of Things (IoT) infrastructures, particularly under resource-constrained deployment conditions. Although transfer learning models have shown promising detection accuracy, their reliability, computational feasibility, and interpretability in operational environments remain insufficiently explored. This study presents an explainability-aware empirical evaluation of seven pre-trained convolutional neural network architectures for multi-class IoT DDoS detection using the CICDDoS2019 dataset and an image-based traffic representation. The analysis integrates performance metrics, reliability-oriented statistics (MCC, Youden Index, confidence intervals), latency and training cost assessment, and interpretability evaluation using Grad-CAM and SHAP. Results indicate that DenseNet and MobileNet-based architectures achieve strong detection performance while demonstrating superior reliability and compact, class-consistent attribution patterns. DenseNet169 offers the strongest reliability and interpretability alignment, whereas MobileNetV3 provides an effective latency-accuracy trade-off for fog-level deployment. The findings emphasize the importance of combining performance, reliability, and explainability criteria when selecting deep learning models for IoT DDoS detection.
Paper Structure (46 sections, 7 equations, 9 figures, 8 tables)

This paper contains 46 sections, 7 equations, 9 figures, 8 tables.

Table of Contents

  1. Introduction
  2. Threat Model and Security Assumptions
  3. Adversary Model
  4. Defender Model
  5. Security Objectives
  6. Background and Related Work
  7. IoT Architecture and Attack Surface
  8. DDoS Threats in IoT Environments
  9. Machine Learning-Based DDoS Detection
  10. Research Methodology
  11. Dataset
  12. Pre-trained Models Selection
  13. Implementation Specification
  14. Experimental Setup
  15. Data Splitting and Evaluation Protocol
  16. ...and 31 more sections

Figures (9)

  • Figure 1: The cybersecurity CIA triad that represents the three pillars of information security: confidentiality, integrity, and availability nist_sp1800_26a.
  • Figure 2: The IoT three-layered architecture azumah2021deep.
  • Figure 3: The proposed research methodology for investigating pre-trained models for DDoS attack detection.
  • Figure 4: Network traffic data transformation into image representation for pre-trained models.
  • Figure 5: The train vesus validation for the pre-trained models for detecting the DDoS attacks.
  • ...and 4 more figures