XAI-SDN: An Explainable Entropy-Guided Machine Learning Framework for Real-Time DDoS Detection in Software Defined Networks
Adeel Ahmad, Ali Akarma, Ahmad Ali, Hammad Muneer, Toqeer Ali Syed
cs.CR · cs.AI · cs.NI
Quick verdict
Claims 99.9987% accuracy / AUC 1.0 on CIC-DDoS2019 SYN with RF+SHAP; credible pipeline but near-ceiling scores, one attack vector, and split-sensitive FPR.
Summary
XAI-SDN is a DDoS detection pipeline for software-defined networks that augments CICFlowMeter's 80 flow statistics with eight Shannon entropy features maintained by a rolling hash-map window of 1,000 flows, classifies each flow with a balanced Random Forest (200 fully grown trees), and attaches exact SHAP TreeExplainer attributions to alerts above threshold 0.70. On the full CIC-DDoS2019 SYN partition (3.59M flows; 70/30 temporal split; 0.86% benign in the test set) it reports 99.9987% accuracy, 99.9621% macro F1, AUC-ROC 1.0000, and 0.0537% FPR; measured single-threaded on an i9-12900K it sustains 0.0165 ms/flow without explanations and ~0.5122 ms/flow with SHAP under 99.14% attack prevalence. Strengths include full-dataset evaluation, a 10-seed ablation, Wilcoxon tests, and transparently reported SHAP overhead. Key limitations: near-ceiling scores on a saturated benchmark with a single attack vector; the authors' own random-split ablation shows FPR of 5.77% ± 5.23%, about two orders of magnitude above the headline; baselines are compared on a 10k/3k subset rather than the full data; and no live SDN/controller deployment is evaluated, so real-time claims rest on offline wall-clock latency.
Review complete
Assessment at a glance
4
risk flags identified
● high 2
● medium 2
● low 0
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Augmenting CICFlowMeter features with eight rolling Shannon entropy metrics lets a Random Forest achieve 99.9987% accuracy, 99.9621% macro F1, and AUC-ROC 1.0000 on the full CIC-DDoS2019 SYN benchmark under a fixed temporal split.
- The O(1) rolling entropy engine plus RF inference sustains 0.0165 ms/flow (60,606 flows/s) and approximately 0.5122 ms/flow with full SHAP explanations under 99.14% attack prevalence on a desktop CPU.
- SHAP TreeExplainer provides per-flow feature attributions that expose canonical SYN-flood signatures (elevated Flow_Bytes/s, targeted destination ports, suppressed FIN flags) and rank source-IP entropy as the fourth most important feature.
- The full 88-dimensional feature set significantly outperforms entropy-only classification (p=0.0020), although the incremental gain over entropy features is not statistically significant (p=0.2500).
Strengths
Full-dataset evaluation without downsampling
Section V trains on all 2,514,862 samples of the CIC-DDoS2019 SYN partition (1.87 GB Syn.csv) with a 70/30 temporal split and 1,077,798 test flows — unusual for this benchmark, where subsampling is common.
Honest self-disclosure of split sensitivity
Section VI-A reports that a 10-seed ablation on stratified random splits yields FPR = 5.77% ± 5.23%, and explicitly labels the headline 0.0537% FPR as a lower bound under favorable temporal ordering — an unusual and commendable concession.
Explainability integrated and costed
Reproducibility artifacts
Degenerate-feature candor
Weaknesses
Benchmark saturation with a single attack vector
Headline FPR is split-fragile and measured at inverted prevalence
Baseline protocol mismatch
No live SDN deployment
O(1) entropy claim underspecified
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
XAI-SDN (Sections I–IV) proposes an entropy-augmented detection pipeline for SDN: eight rolling Shannon entropy features over a 1,000-flow window are appended to CICFlowMeter's 80 statistics, feeding a class-balanced Random Forest whose alerts above τ=0.70 receive exact SHAP TreeExplainer attributions. The central empirical claims (Tables III–IV): on the full CIC-DDoS2019 SYN partition — 3.59M flows, 70/30 temporal split, test set 99.14% DDoS (Table I) — the system reaches 99.9987% accuracy, 99.9621% macro F1, AUC-ROC 1.0000, FPR 0.0537%, at 0.0165 ms/flow without and ≈0.5122 ms/flow with SHAP explanations. A further claim is architectural: the pipeline embeds in an SDN control plane (Ryu/OpenFlow, 500 ms polling, Fig. 1) as a real-time, line-rate-capable defense.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is XAI-SDN?
XAI-SDN is an explainable DDoS detection framework for software-defined networks. It enriches standard CICFlowMeter flow statistics with eight Shannon entropy features maintained over a rolling 1,000-flow window, classifies each flow with a Random Forest, and attaches SHAP feature attributions to alerts so operators can see why a flow was flagged.
How accurate is XAI-SDN on the CIC-DDoS2019 dataset?
On the full SYN-flood partition (3.59 million flows, 70/30 temporal split) the paper reports 99.9987% accuracy, 99.9621% macro F1, AUC-ROC 1.0000, and 0.0537% false positive rate. However, the authors' own ablation over 10 random splits shows FPR of 5.77% ± 5.23%, so the headline figure depends strongly on the favorable temporal ordering of the single split used.
How fast does XAI-SDN run?
Measured single-threaded on an Intel i9-12900K: 0.0165 ms per flow (about 60,600 flows/second) for classification alone, and roughly 0.5122 ms per flow (about 1,953 flows/second) when SHAP explanations are generated for 99.14% DDoS traffic. These are offline measurements on dataset files, not results from a live SDN controller deployment.
What are the main limitations of the paper?
Evaluation covers only the SYN attack vector of CIC-DDoS2019, whose scores are near ceiling (14 misclassifications in 1.08M test flows); baselines are compared on a small 10K/3K subset rather than the full data; no real SDN controller or testbed experiment is reported; and no evaluation exists under benign-majority traffic prevalence typical of production networks.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Review is based on the provided PDF extraction of the arXiv v1 text; figure images (Figs. 1-3) are represented only by their captions and axis labels in the extraction, so visual details of the ROC curves could not be inspected.
- The claimed public code repository (github.com/adeliusa486/XAI-SDN) was not accessed; its completeness and runnable state are unverified in this review.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.