Explainable DDoS Detection with a CNN-LSTM Hybrid Model and SHAP Interpretation

The rising frequency and complexity of Distributed Denial of Service (DDoS) attacks pose a severe threat to network security. This study aims to develop an effective and interpretable DDoS detection framework using a hybrid deep learning approach. The proposed method integrates Convolutional Neural Networks (CNN) to capture local traffic patterns and Long Short-Term Memory (LSTM) networks to model temporal dependencies. The CICIDS 2017 dataset, after preprocessing steps including data cleaning, standardization, and class balancing with SMOTE, was used to train and evaluate the model. Experimental results show that the framework achieved 99.98% accuracy and a 99.83% F1-Score, with minimal false positive and false negative rates. This study integrates SHAP to improve model interpretability, aligning feature importance with network security expertise. Future research will focus on real-time deployment, cross-dataset validation, and exploring alternative explainable AI techniques for improved scalability.