A Hybrid SHAP and Hotelling’s T²-Based Feature Selection Framework for Deep Learning-Based DDoS Intrusion Detection

Abstract

As cyberattacks are increasing in today’s digital world, especially Distributed Denial of Service attacks, securing network resources has become crucial for both individuals and network administrators. Here comes the need for a reliable and trusted Intrusion Detection System, which plays a significant role in determining and detecting threats by monitoring network traffic and alerting the network administrator. Therefore, we have designed and evaluated a deep learning-based IDS that focuses on DDoS network attacks using a popular dataset. This CICDDoS2019 dataset contains a wide range of network traffic patterns. To strengthen the model’s performance, we have used the Shapley method for feature selection along with the Hotelling T² test to choose the top contributing set of features, which contribute the most in deciding whether there is an attack or not. The feature selection method reduced the original 87 features to the 21 most predictive attributes. After selecting the features, we used a dense multilayer perceptron (MLP) — a deep learning model well-known for recognising complex data patterns. The model was trained and tested on the optimal dataset to differentiate benign and DDoS network attacks. The model performance is evaluated using metrics like accuracy, recall, precision, balanced accuracy, and F1-score. The results show that combining Shapley with the Dense MLP model achieved 99.75±0.020% accuracy with consistently high precision (99.72±0.037%), recall (99.78±0.012%), and ROC-AUC (>0.995) across datasets on three independent runs. The proposed framework also demonstrated highly accurate detection of DDoS attacks, maintaining a low false-positive rate while effectively distinguishing malicious traffic from legitimate network activities. This study shows the impact of meaningful feature selection in enhancing the predictive capability of deep learning models for intrusion detection. The results demonstrate that integrating meaningful feature selection with deep learning strengthens IDS performance offers a practical, interpretable, and computationally efficient solution for real-time DDoS detection.