Abstract
Distributed Denial-of-Service (DDoS) attacks constitute a persistent and evolving threat to cloud computing environments because they can exploit the scalability, openness, virtualization, and multi-tenant characteristics of cloud infrastructure. Although machine learning and deep learning have increasingly improved DDoS detection, the black-box nature of many artificial intelligence models presents an important challenge for security administrators who must understand, validate, and act upon automated predictions. A highly accurate model that cannot explain why network traffic has been classified as malicious may be difficult to trust in operational cloud environments. This study proposes an Explainable Artificial Intelligence (XAI) framework for the early detection of DDoS attacks in cloud computing environments. The proposed framework integrates cloud traffic monitoring, network-flow feature extraction, preprocessing, machine-learning-based detection, temporal early-warning analysis, and explainability mechanisms based primarily on SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME). The framework is designed to distinguish legitimate traffic from emerging DDoS behaviour before substantial resource exhaustion occurs while simultaneously providing global and local explanations of model decisions. CIC-DDoS2019 is proposed as a principal benchmark because it contains realistic benign traffic and multiple contemporary DDoS attack families with more than 80 extracted flow features. The framework can subsequently be validated against additional datasets and a controlled cloud environment. The study evaluates detection accuracy, precision, recall, F1-score, false-positive rate, area under the ROC curve, detection latency, and explanation fidelity. The proposed research contributes a human-centred approach to intelligent cloud security in which detection performance and interpretability are treated as complementary requirements rather than competing objectives.
Keywords: Explainable Artificial Intelligence, DDoS, cloud computing, machine learning, SHAP, LIME, intrusion detection, early detection, cybersecurity, cloud security.
Introduction
Cloud computing has fundamentally changed the way computing resources are delivered and consumed. Organizations increasingly depend on cloud infrastructure for data storage, software applications, e-commerce, financial transactions, communication, artificial intelligence, and critical business operations. The elasticity and on-demand resource allocation offered by cloud platforms provide considerable economic and technical advantages. However, these same characteristics introduce security challenges, particularly because cloud services expose large and dynamic attack surfaces.Distributed Denial-of-Service (DDoS) attacks are among the most significant threats to cloud-service availability. A DDoS attack attempts to overwhelm a target by coordinating traffic or requests from multiple sources. In cloud environments, the consequences can be particularly complex because attacks may exhaust network bandwidth, virtual-machine resources, application capacity, load-balancing infrastructure, or other shared resources. A recent systematic review of cloud DDoS research identifies detection, prevention, and mitigation as continuing challenges and emphasizes the need for adaptive AI-based defence mechanisms. ([ScienceDirect][1])The problem becomes more difficult when attackers use low-rate or application-layer traffic. Unlike obvious volumetric attacks, these attacks may resemble legitimate user activity. Consequently, simple traffic-volume thresholds may generate excessive false alarms or fail to detect an attack during its early stages.Machine learning has emerged as a promising solution because it can learn patterns from network traffic and identify relationships that may not be easily captured through manually defined rules. However, the adoption of machine-learning systems in security operations creates another problem: **explainability**.Many modern machine-learning and deep-learning models operate as black boxes. They may produce highly accurate predictions without providing an understandable explanation of why a particular flow was classified as malicious. In a security environment, this limitation is important. A security analyst may need to know whether a decision was caused by unusually high packet rates, abnormal flow duration, unusual inter-arrival times, destination concentration, or another characteristic.Explainable Artificial Intelligence provides mechanisms for addressing this problem. SHAP, for example, can quantify the contribution of individual features to a model's prediction, while LIME can provide local approximations of complex models. Previous DDoS research has demonstrated the feasibility of combining machine-learning detection with SHAP-based explanations, including work reporting global and local explanations for DDoS classification. ([arXiv][2])Recent research has moved further toward explainable DDoS defence in cloud environments. A 2025 study integrating SHAP and LIME with deep-learning models evaluated DDoS detection using CICIDS2017, CICIDS2018, CICDDoS2019, and a custom OpenStack environment, demonstrating the growing importance of explainability and real-time cloud deployment. ([ScienceDirect][3])The present study therefore proposes an XAI framework specifically emphasizing early detection. The central premise is that the value of a DDoS detection system is not merely its ability to classify an attack correctly, but its ability to identify suspicious behaviour sufficiently early to support preventive action and explain that decision to security personnel.
Problem Statement
Traditional DDoS detection systems commonly rely on signatures, static thresholds, traffic-volume analysis, or manually designed rules. These approaches can be effective against known and highly visible attacks but may struggle in dynamic cloud environments.Cloud traffic is inherently variable. Legitimate traffic can increase dramatically during business events, promotional campaigns, software releases, examinations, online registration periods, or unexpected demand. Therefore, a detector based solely on traffic volume may incorrectly classify legitimate surges as attacks.Machine-learning systems can improve detection by learning more complex traffic patterns. However, several problems remain. First, many studies focus primarily on predictive accuracy. High accuracy does not necessarily imply effective early detection. Second, many models are evaluated using random training and testing splits from the same benchmark dataset. Such evaluation may overestimate generalization to new cloud environments. Third, DDoS datasets may contain severe class imbalance, meaning that accuracy can conceal poor attack detection. Fourth, complex models can be difficult for security analysts to interpret. Fifth, detecting an attack after cloud resources have already been substantially exhausted may provide limited practical benefit. The research problem can therefore be expressed as follows: How can an accurate and computationally efficient artificial intelligence system detect DDoS attacks at an early stage in cloud computing environments while providing understandable explanations that support security analysts' decisions? This question distinguishes conventional DDoS classification from the proposed concept of explainable early-warning detection.
Aim and Objectives
Aim
The primary aim of this study is to develop an Explainable Artificial Intelligence framework capable of detecting DDoS attacks at an early stage in cloud computing environments while providing interpretable explanations of its predictions.
Objectives
The study seeks to: 1. identify network-flow characteristics associated with early-stage DDoS behaviour in cloud environments; 2. develop a machine-learning model for DDoS detection;3. develop an early-warning mechanism capable of identifying attacks before significant resource exhaustion occurs; 4. integrate SHAP and LIME to explain model predictions; 5. evaluate the framework using established DDoS datasets; 6. examine the effect of feature selection on early detection; 7. evaluate the framework using detection accuracy, recall, F1-score, false-positive rate, AUC, and detection latency; 8. examine the generalizability of the framework across different datasets and cloud environments; and 9. develop an interpretable decision-support mechanism for cloud-security administrators.
Research Questions
The study will address the following research questions:
RQ1: Which network-flow characteristics are most effective for identifying DDoS attacks during their early stages? RQ2: How accurately can machine-learning models distinguish early-stage DDoS traffic from legitimate cloud traffic? RQ3: Can an XAI-enabled model provide meaningful explanations for early DDoS detection decisions? RQ4: Does integrating temporal traffic characteristics improve early detection compared with conventional flow-based classification? RQ5: How does the proposed framework perform in terms of false-positive rate and detection latency? RQ6: How well does the framework generalize across different DDoS datasets and cloud environments?
Literature Review
DDoS Attacks in Cloud Computing
Cloud computing introduces several characteristics that influence DDoS risk. Virtualization allows multiple services and customers to share physical resources, while elasticity permits infrastructure to dynamically allocate additional resources in response to demand.Although elasticity can provide resilience, it can also complicate attack detection. An attack may initially appear as ordinary demand, causing cloud resources to scale before the malicious nature of the traffic becomes obvious. Consequently, the cloud provider may incur additional resource costs while legitimate users experience degraded performance.Application-layer attacks present an additional challenge because malicious requests can closely resemble legitimate requests. Research reviewing cloud DDoS defence identifies application-layer attacks as particularly difficult to detect because malicious traffic can be difficult to distinguish from normal flows. ([ScienceDirect][4])
Machine Learning for DDoS Detection
Machine learning transforms network traffic into measurable features and uses these features to distinguish legitimate and malicious behaviour.
A traffic observation can be represented as: X=(x_1,x_2,\ldots,x_n)
where the variables may represent: packet count; byte count; flow duration; packet rate; byte rate; protocol; port; packet-size statistics; inter-arrival time; source and destination behaviour.
The model estimates: P(Y|X). where \(Y\) represents the traffic class.
The Canadian Institute for Cybersecurity's CIC-DDoS2019 dataset provides a useful benchmark because it contains realistic benign traffic and multiple DDoS attack types. The dataset includes attacks such as NTP, DNS, LDAP, MSSQL, NetBIOS, SNMP, SSDP, UDP, UDP-Lag, WebDDoS, SYN, and TFTP, with more than 80 traffic features extracted through CICFlowMeter-V3. However, a classification model that determines whether a completed traffic flow is malicious may not necessarily detect an attack early enough. This motivates the temporal component of the proposed framework.
Explainable Artificial Intelligence
Explainable AI refers to techniques that enable humans to understand the reasoning behind AI predictions.For cybersecurity, explainability is particularly valuable because automated decisions can have significant operational consequences. Blocking a legitimate cloud service because of a false positive may be almost as damaging as failing to detect an attack.
SHAP
SHAP is based on Shapley values from cooperative game theory.
A simplified representation of a prediction is: f(x)=\phi_0+\sum_{i=1}^{n}\phi_i
where: \(f(x)\) is the model prediction; \(\phi_0\) is the baseline prediction; \(\phi_i\) represents the contribution of feature \(i\). A positive SHAP value can indicate that a feature pushes a prediction toward the DDoS class, whereas a negative value can indicate that it pushes the prediction toward legitimate traffic.
SHAP therefore provides two important forms of interpretation: Global explanation: Which features generally influence DDoS predictions across the dataset?Local explanation:Why was this particular traffic flow classified as malicious?Previous research applying SHAP to DDoS detection demonstrates that XAI can reveal important traffic features while preserving the predictive capabilities of machine-learning models. ([arXiv][2])
LIME
LIME provides local explanations by approximating a complex model around a specific prediction with an interpretable model.For example, if the proposed system classifies a particular cloud traffic flow as DDoS, LIME can identify the local features that contributed most strongly to that prediction.The complementary use of SHAP and LIME is valuable because SHAP can provide a consistent feature-attribution framework while LIME emphasizes local interpretability.Research comparing the two approaches in DoS detection has similarly noted their different strengths in global and local interpretation. ([DOI][5])
Proposed Explainable Early-DDoS Detection Framework
The proposed framework consists of seven interconnected layers: Layer 1: Cloud Traffic Acquisition. Traffic information is collected from cloud gateways, virtual switches, load balancers, firewalls, network interfaces, or cloud-monitoring systems. Layer 2: Flow Construction. Raw packets are converted into flow-level observations. Layer 3: Pre-processing and Feature Engineering. The system removes irrelevant variables, handles missing data, normalizes appropriate features, and constructs temporal indicators. Layer 4: Early-Warning Detection. The machine-learning model continuously evaluates traffic windows rather than waiting for an attack to fully develop. Layer 5: XAI Explanation. SHAP and LIME generate explanations for detected events. Layer 6: Risk Scoring. The system combines the prediction probability, anomaly score, and temporal persistence of suspicious activity. Layer 7: Security Response. The final risk assessment can support actions such as enhanced monitoring, rate limiting, traffic filtering, isolation, or escalation to a security administrator.
The conceptual architecture is:Cloud Traffic↓Flow Monitoring↓Feature Extraction↓Temporal Windowing↓ML Detection Model↓Early DDoS Risk Score↓SHAP + LIME↓Human-Interpretable Explanation↓Mitigation Recommendation
Early Detection Mechanism
Early detection represents the principal distinction between the proposed framework and conventional DDoS classification. Rather than waiting until an entire attack has occurred, traffic is examined within consecutive time windows: W_1, W_2, W_3,\ldots, W_tFor each window, the model produces: P_t=P(DDoS|X_t)An early-warning score can then be constructed as: E_t=\alpha P_t+\beta A_t+\gamma T_twhere:\(P_t\) = DDoS probability;\(A_t\) = anomaly score;\(T_t\) = temporal persistence;\(\alpha,\beta,\gamma\) = weighting parameters. A potential attack should not necessarily be declared from a single anomalous observation. Instead, repeated suspicious behaviour across consecutive windows can increase confidence. For example: E_t>\taufor \(k\) consecutive windows can trigger an early-warning event. This approach is intended to reduce false positives caused by isolated traffic anomalies.
Research Methodology
Research Design
The proposed study adopts a quantitative experimental research design.The experiment will compare candidate machine-learning models under identical preprocessing, training, and evaluation conditions.Potential models include: Logistic Regression; Random Forest; Gradient Boosting; XGBoost; Support Vector Machine; Multilayer Perceptron; and an appropriate temporal deep-learning model such as LSTM.The final model should be selected based not only on predictive performance but also on computational cost and explainability.
Dataset
CIC-DDoS2019 will serve as a principal benchmark because it was designed specifically for DDoS research and contains multiple contemporary DDoS attack categories and flow-based features. Additional datasets should be used where possible to test generalization.A particularly important experimental extension would be the use of a controlled OpenStack environment. Recent cloud-focused research has already demonstrated the feasibility of combining public DDoS datasets with realistic OpenStack simulations for evaluating explainable detection systems. ([ScienceDirect][3])This would allow the research to move beyond benchmark classification toward cloud-specific validation.
Feature Engineering
The proposed feature groups include: Traffic-volume features: packets per second; bytes per second; total packets; total bytes. Connection features: number of flows; connection frequency; source-IP diversity; destination concentration. Temporal features: mean inter-arrival time; standard deviation of inter-arrival time; burst duration; flow persistence. Protocol features: TCP/UDP distribution; SYN/ACK behaviour; source and destination ports. Cloud-resource features: Where available, cloud-specific variables should also be incorporated: CPU utilization; memory utilization; network throughput; virtual-machine response time; request latency; connection queue size. The combination of network and resource-level features is important because DDoS attacks ultimately affect both network behaviour and cloud-resource availability.
Model Evaluation
The proposed framework should be evaluated using several complementary metrics. Accuracy Accuracy=\frac{TP+TN}{TP+TN+FP+FN} Precision Precision=\frac{TP}{TP+FP}Recal lRecall=\frac{TP}{TP+FN} F1-scoreF1=2\frac{Precision\times Recall}{Precision+Recall} False-positive rate FPR=\frac{FP}{FP+TN} Detection latency Detection latency should measure the time between the beginning of measurable attack behaviour and the first reliable warning generated by the framework. This metric is particularly important because the proposed research focuses on **early detection**.A model with slightly lower F1-score but significantly shorter detection latency could be more useful operationally than a highly accurate model that identifies attacks only after substantial resource degradation.
Explainability Evaluation
An important doctoral contribution would be to evaluate explainability quantitatively rather than simply displaying SHAP or LIME plots. The study can evaluate explanations according to: Fidelity: Does the explanation accurately represent the behaviour of the underlying model? Stability: Does the explanation remain reasonably consistent when small changes are introduced to the same traffic observation? Consistency: Do different explanation methods identify similar influential features? Usefulness: Can a security analyst understand the explanation sufficiently to support an appropriate response?A possible explanation-quality score could be defined as:XQI=w_1F+w_2S+w_3C+w_4Uwhere: \(F\) = fidelity; \(S\) = stability; \(C\) = consistency; \(U\) = analyst usefulness.The weighting parameters can be determined empirically. This would strengthen the research because explainability would become an experimentally evaluated component rather than merely a visualization feature.
Expected Contributions
The proposed research is expected to make five principal contributions.1 Early-Warning Contribution: The framework shifts attention from identifying DDoS attacks after substantial damage to detecting behavioural changes at an earlier stage. 2 Explainability Contribution: The integration of SHAP and LIME provides security analysts with understandable explanations of automated decisions. 3 Cloud-Specific Contribution: Combining network traffic with cloud-resource indicators can provide a more complete representation of attacks in virtualized environments.4 Methodological Contribution: The research proposes evaluation across predictive performance, detection latency, computational efficiency, and explanation quality.5 Practical Contribution: The framework can serve as a decision-support mechanism for cloud-security teams by translating complex model predictions into actionable information.
Research Gaps and Significance
Although recent research increasingly combines DDoS detection with XAI, several gaps remain.First, explainability is frequently treated as an additional visualization layer rather than a core component of security decision-making.Second, many studies emphasize accuracy without adequately measuring **how early** attacks can be detected.Third, benchmark datasets may not adequately represent the dynamic nature of cloud environments.Fourth, explanations are not always evaluated for fidelity, stability, or usefulness.Fifth, cloud-specific resource metrics are not consistently integrated with network-flow information.Recent research demonstrates that XAI-enabled cloud DDoS systems are becoming more sophisticated. For example, recent work has combined XAI with KAN, CNN, LSTM, and GRU architectures and evaluated the systems using both public datasets and an OpenStack environment. ([ScienceDirect][3]) Another recent study proposed an explainable framework combining WGAN-GP, attention-LSTM, adaptive thresholding, and SHAP for low-rate API-based DDoS attacks in cloud environments, demonstrating the direction toward integrated, interpretable detection systems. ([ScienceDirect][6])These developments reinforce the significance of the proposed research while also revealing an opportunity to emphasize **early warning, explanation quality, and operational decision support** as unified research objectives.---
Conclusion
DDoS attacks represent a serious threat to the availability and reliability of cloud computing services. The dynamic, elastic, and multi-tenant characteristics of cloud infrastructure make conventional threshold- and signature-based approaches increasingly inadequate for detecting sophisticated attacks, particularly low-rate and application-layer attacks.Machine learning provides an opportunity to identify complex behavioural patterns in network traffic. However, predictive accuracy alone is insufficient for security-critical cloud environments. Security administrators need to understand why an AI system has identified traffic as malicious, particularly when automated decisions may result in traffic filtering, resource isolation, or service restrictions.This study proposed an Explainable Artificial Intelligence framework for the early detection of DDoS attacks in cloud computing environments. The framework integrates cloud traffic monitoring, flow-level feature extraction, temporal analysis, machine-learning detection, SHAP and LIME explainability, risk scoring, and mitigation support.The central innovation is the integration of **early detection and explainability**. Rather than simply determining whether a completed network flow represents an attack, the proposed framework continuously monitors traffic behaviour and attempts to identify suspicious patterns before substantial resource exhaustion occurs. The explanation layer then identifies the network or resource characteristics responsible for the prediction.CIC-DDoS2019 provides a strong initial benchmark because it contains realistic benign traffic, multiple contemporary DDoS attack categories, and more than 80 flow-level traffic features. However, a robust doctoral investigation should extend beyond benchmark evaluation by validating the framework using additional datasets and a controlled cloud environment such as OpenStack.The proposed study therefore moves toward a more human-centred cybersecurity paradigm. The objective is not merely to develop a highly accurate artificial intelligence system but to develop an AI system that is **early, accurate, interpretable, adaptive, and operationally useful**.Ultimately, the proposed framework can contribute to the development of intelligent cloud-security systems in which machine-learning predictions are combined with understandable explanations and timely intervention. Such systems have the potential to improve the ability of cloud providers and organizations to identify emerging DDoS attacks before they develop into severe service disruptions while simultaneously increasing confidence in AI-assisted cybersecurity decision-making.
References
Kumar, S., Dwivedi, M., Kumar, M., & Gill, S. S. (2024). A comprehensive review of vulnerabilities and AI-enabled defense against DDoS attacks for securing cloud services. Computer Science Review, 53, 100661. ([ScienceDirect][4])Sharafaldin, I., Lashkari, A. H., Hakak, S., & Ghorbani, A. A. (2019). Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy. IEEE 53rd International Carnahan Conference on Security Technology. Canadian Institute for Cybersecurity. Wei, Y., Jang-Jaccard, J., Singh, A., Sabrina, F., & Camtepe, S. (2023). Classification and explanation of Distributed Denial-of-Service (DDoS) attack detection using machine learning and Shapley Additive Explanation (SHAP) methods. arXiv. ([arXiv][2])Transparent DDoS defense by combining Kolmogorov–Arnold networks and XAI for real-time protection in cloud environments. (2025). Telecommunications and related research. ([ScienceDirect][3])An explainable generative AI framework for detecting low-rate API-based DDoS attacks in cloud environments. (2026). Results in Engineering. ([ScienceDirect][6])Analyzing the Role of LIME and SHAP in Explainable DoS Attack Detection for IoT Systems. (2025). IEEE International Conference on Automation, Computing and Renewable Systems. ([DOI][5])Explainable AI-Based DDoS Attacks Classification Using Deep Transfer Learning. (2024). ([ScienceDirect][7])Automated and Explainable Denial of Service Analysis for AI-Driven Intrusion Detection Systems. (2025). arXiv. ([arXiv][8])For the next paper, would you prefer a quantitative empirical version with hypotheses and statistical tests, a full PhD Chapter 1–3 version, or an IEEE-style journal version?