# Automated and Explainable Denial of Service Analysis for AI-Driven Intrusion Detection Systems

arXiv: https://arxiv.org/abs/2511.04114 · HTML: https://mlsanity.com/paper/2511.04114/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 32 references that are in the map.
- First posted on arXiv 6 Nov 2025.

## Builds on (most cited first, 4 of 4)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Evaluation of a Tree-based Pipeline Optimization Tool for Automating Data Science](https://mlsanity.com/paper/1603.06212/) (2016)
- [Machine Learning-Based Intrusion Detection: Feature Selection versus Feature Extraction](https://mlsanity.com/paper/2307.01570/) (2023)
- [Exploring Feature Importance and Explainability Towards Enhanced ML-Based DoS Detection in AI Systems](https://mlsanity.com/paper/2411.03355/) (2024)

## Built on by (most cited first, 1 of 1)

- [Multi-Class, Multi-Tier Network Intrusion Detection: A Comprehensive and Reproducible Benchmark](https://mlsanity.com/paper/2609.36039/) (2026)

## Abstract (arXiv)

With the increasing frequency and sophistication of Distributed Denial of Service (DDoS) attacks, it has become critical to develop more efficient and interpretable detection methods. Traditional detection systems often struggle with scalability and transparency, hindering real-time response and understanding of attack vectors. This paper presents an automated framework for detecting and interpreting DDoS attacks using machine learning (ML). The proposed method leverages the Tree-based Pipeline Optimization Tool (TPOT) to automate the selection and optimization of ML models and features, reducing the need for manual experimentation. SHapley Additive exPlanations (SHAP) is incorporated to enhance model interpretability, providing detailed insights into the contribution of individual features to the detection process. By combining TPOT's automated pipeline selection with SHAP interpretability, this approach improves the accuracy and transparency of DDoS detection. Experimental results demonstrate that key features such as mean backward packet length and minimum forward packet header length are critical in detecting DDoS attacks, offering a scalable and explainable cybersecurity solution.