Abstract
Distributed denial-of-service (DDoS) attacks threaten the availability of Internet of Things (IoT) infrastructures, particularly under resource-constrained deployment conditions. Although transfer learning models have shown promising detection accuracy, their reliability, computational feasibility, and interpretability in operational environments remain insufficiently explored. This study presents an explainability-aware empirical evaluation of seven pre-trained convolutional neural network architectures for multi-class IoT DDoS detection using the CICDDoS2019 dataset and an image-based traffic representation. The analysis integrates performance metrics, reliability-oriented statistics (MCC, Youden Index, confidence intervals), latency and training cost assessment, and interpretability evaluation using Grad-CAM and SHAP. Results indicate that DenseNet and MobileNet-based architectures achieve strong detection performance while demonstrating superior reliability and compact, class-consistent attribution patterns. DenseNet169 offers the strongest reliability and interpretability alignment, whereas MobileNetV3 provides an effective latency-accuracy trade-off for fog-level deployment. The findings emphasize the importance of combining performance, reliability, and explainability criteria when selecting deep learning models for IoT DDoS detection.
Abstract (translated)
分布式拒绝服务（DDoS）攻击威胁到物联网（IoT）基础设施的可用性，尤其是在资源受限的部署条件下。虽然迁移学习模型展示了令人鼓舞的检测准确率，但在操作环境中的可靠性、计算可行性及可解释性方面仍存在不足之处。本研究通过对CICDDoS2019数据集和基于图像的流量表示进行多类IoT DDoS检测，对七种预训练卷积神经网络架构进行了具有解释性的实证评估。该分析结合了性能指标、面向可靠性的统计量（MCC，Youden指数，置信区间），延迟及训练成本评估，以及使用Grad-CAM和SHAP进行的可解释性评价。结果显示，DenseNet和MobileNet架构在检测表现方面表现出色，并展示了卓越的可靠性与紧凑且类别一致的属性模式。DenseNet169提供了最强的可靠性和可解释性的契合度，而MobileNetV3则为雾计算级别的部署提供了一个有效的延迟-准确性权衡方案。研究结果强调了在选择用于IoT DDoS检测的深度学习模型时，应综合考虑性能、可靠性及可解释性标准的重要性。
URL
https://arxiv.org/abs/2602.22488
