An explainable stacking ensemble machine learning model for denial-of-service attack detection

The evolving sophistication of cyber threats, particularly denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, poses significant challenges to the modern cybersecurity systems, availability, and reliability of digital infrastructures. These attacks often overwhelm network resources, leading to service disruptions and potential data breaches. Traditional intrusion detection systems (IDS) have been developed to mitigate such threats; however, they often struggle with scalability, detection accuracy, and interpretability, especially when processing large-scale network traffic. To address these limitations, this study proposes a stacked ensemble intrusion detection model integrating Decision Tree (DT), Random Forest (RF), and Artificial Neural Network (ANN) classifiers as base learners, with Logistic Regression (LR) serving as the meta-learner. The framework aims to enhance detection accuracy, interpretability, and robustness against DoS and DDoS attacks. Using the CIC-IDS2017 dataset, Mutual Information (MI) was employed for optimal feature selection, ensuring the most relevant attributes were retained for training. SHAP (Shapley Additive exPlanations) was applied to interpret the contribution of each selected feature to the model’s decision-making process. Experimental results demonstrate that the proposed ensemble achieves superior performance compared to individual classifiers and baseline models, with 98.83% accuracy, 96.37% precision, 99.19% recall, 97.76% F1-score, and an AUC of 0.9995. Compared with the baseline [1], accuracy improved by 3.39% and F1-score by 1.57%. SHAP analysis identified flow-based and packet-based features as key contributors in distinguishing normal and malicious traffic. Overall, combining multiple learning algorithms within a stacked ensemble, along with MI feature selection and SHAP explainability, provides a robust, transparent, and effective solution for real-time intrusion detection.