Explainable XGBoost-Based Detection of IoT DDoS Attacks Using SHAP Analysis

Abstract

The rapid growth of Internet of Things (IoT) networks, accelerated by 5G technologies, has expanded the attack surface and increased vulnerability to Distributed Denial-of-Service (DDoS) attacks. Although machine learning techniques have demonstrated strong detection performance, many intrusion detection systems operate as black-box models, limiting their transparency. To address this limitation, this study proposes an explainable intrusion detection framework based on XGBoost integrated with SHapley Additive exPlanations (SHAP). Evaluated on the ACI-IoT-2023 dataset for binary classification of benign and DDoS traffic, the proposed framework demonstrated high detection performance, achieving 99.93% accuracy and 99.94% F1-score while maintaining a low inference time suitable for real-time intrusion detection. Beyond performance evaluation, explainability analysis was conducted using global and local SHAP analyses, statistical feature behavior analysis, misclassification analysis, and synthetic feature-based validation. The results reveal that temporal traffic characteristics, particularly Idle Max and Flow IAT Min, together with protocol-related behavior, represent the most influential factors in distinguishing malicious from benign traffic. The findings further demonstrate that the proposed framework learns stable and interpretable traffic patterns rather than relying on isolated feature values or arbitrary statistical correlations. Overall, this study shows that integrating tree-based machine learning with explainable artificial intelligence can significantly improve both the effectiveness and transparency of intrusion detection systems.