Temporal-XAI: An Attention-Based Explainable Framework for DoS Attack Detection with Temporal Pattern Analysis

With the emergence of sophisticated Denial of Service (DoS) attacks targeting modern networks, effective detection mechanisms are crucial for maintaining system availability and security. While deep learning-based intrusion detection systems have shown remarkable performance, their black-box nature limits their interpretability and trustworthiness for security practitioners. This paper introduces Temporal-XAI, a novel explainable AI framework that enhances DoS attack detection by explicitly modeling and explaining temporal attack patterns. Our approach combines a temporal attention mechanism with feature importance attribution to provide multi-level explanations of detected attacks. Unlike existing methods that focus on static feature analysis, Temporal-XAI captures the sequential nature of network traffic and explains how traffic patterns evolve during an attack. The framework extracts time-sensitive features from network flows and employs a self-attention mechanism to identify critical time points that contribute to attack classification decisions. We evaluate our approach on three benchmark datasets: CICIDS-2017, NSL-KDD, and a custom 5G network dataset, demonstrating superior performance with F1-scores of 99.3%, 98.7%, and 97.8% respectively. Compared to state-of-the-art explainable methods like SHAP and LIME, our temporal explanation approach provides 27% more actionable insights for security analysts, as validated through a user study with cybersecurity experts. Temporal-XAI not only improves detection accuracy but also enhances model transparency, enabling security teams to understand attack progression patterns and develop more effective defense mechanisms.