Identification of DDoS Attacks Through SHAP-Based Feature Analysis and Transformer Models: A Multivariate Time Series Data Approach

DDoS attacks are pervasive and lead to significant economic losses because they are cost-effective and rely on readily available resources. This study introduces crucial features identified through SHAP-based analysis to capture the temporal characteristics of DDoS attacks within the Transformer model. The potential for improving online detection and classification of DDoS attacks using reduced features is evident and thoroughly discussed. The simulation results demonstrate that reducing to 20 features with selected input window sizes yields optimal performance, reaching an F1 Score of up to 99.58%. This improvement could greatly enhance real-time defense mechanisms, particularly in identifying attacks promptly when they occur in a streaming fashion.