SHAP-Based Feature Selection for Multi-Algorithm DDoS Attack Detection: A Comparative Study

Authors

  • Raxmatov Furqat Abdirazzoqovich Associate Professor, Department of Computer Systems, Tashkent University of Information Technologies named after Muhammad al-Khwarizmi
  • Toshtemirov Muxammadi Shokir o‘g‘li Master’s Student (2nd year), Tashkent University of Information Technologies named after Muhammad al-Khwarizmi

Keywords:

DDoS attacks, SHAP, Random Forest

Abstract

Distributed Denial of Service (DDoS) attacks, which pose a significant threat to network security, have been increasing in both scale and complexity over time. This paper proposes a machine learning–based approach optimized using SHAP (SHapley Additive exPlanations) to address the problem of real-time DDoS attack detection. To the best of our knowledge, this study is among the first to apply SHAP-based feature selection consistently across three international benchmark datasets—CIC-DDoS2019, UNSWNB15, and Network Intrusion (CIC-IDS2017)—and to conduct a comprehensive comparison using four algorithms: Random Forest, K-Nearest Neighbors (KNN), XGBoost, and LightGBM

Downloads

Published

2026-04-09

Issue

Vol. 52 (2026): EJET

Section

Articles

License

Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.

How to Cite

SHAP-Based Feature Selection for Multi-Algorithm DDoS Attack Detection: A Comparative Study. (2026). Eurasian Journal of Engineering and Technology, 52, 14-28. https://geniusjournals.org/index.php/ejet/article/view/7437