Explainability-Aware Evaluation of Transfer Learning Models for IoT DDoS Detection Under Resource Constraints
This work addresses the need for reliable and interpretable DDoS detection in resource-constrained IoT environments, though it is incremental as it focuses on empirical evaluation of existing models.
The study tackled the problem of evaluating transfer learning models for IoT DDoS detection under resource constraints by conducting an explainability-aware empirical analysis, finding that DenseNet169 achieved strong reliability and interpretability alignment while MobileNetV3 offered an effective latency-accuracy trade-off for fog-level deployment.
Distributed denial-of-service (DDoS) attacks threaten the availability of Internet of Things (IoT) infrastructures, particularly under resource-constrained deployment conditions. Although transfer learning models have shown promising detection accuracy, their reliability, computational feasibility, and interpretability in operational environments remain insufficiently explored. This study presents an explainability-aware empirical evaluation of seven pre-trained convolutional neural network architectures for multi-class IoT DDoS detection using the CICDDoS2019 dataset and an image-based traffic representation. The analysis integrates performance metrics, reliability-oriented statistics (MCC, Youden Index, confidence intervals), latency and training cost assessment, and interpretability evaluation using Grad-CAM and SHAP. Results indicate that DenseNet and MobileNet-based architectures achieve strong detection performance while demonstrating superior reliability and compact, class-consistent attribution patterns. DenseNet169 offers the strongest reliability and interpretability alignment, whereas MobileNetV3 provides an effective latency-accuracy trade-off for fog-level deployment. The findings emphasize the importance of combining performance, reliability, and explainability criteria when selecting deep learning models for IoT DDoS detection.