Explainability-Aware Evaluation of Transfer Learning Models for IoT DDoS Detection Under Resource Constraints

TL;DR

This paper evaluates transfer learning models for IoT DDoS detection, emphasizing explainability, reliability, and resource efficiency, and identifies DenseNet169 and MobileNetV3 as top performers for different deployment needs.

Contribution

It provides an explainability-aware empirical assessment of seven CNN architectures for IoT DDoS detection, integrating performance, reliability, latency, and interpretability metrics.

Findings

DenseNet169 offers the best reliability and interpretability.

MobileNetV3 balances latency and detection accuracy.

Models demonstrate strong detection with explainability and resource efficiency.

Abstract

Distributed denial-of-service (DDoS) attacks threaten the availability of Internet of Things (IoT) infrastructures, particularly under resource-constrained deployment conditions. Although transfer learning models have shown promising detection accuracy, their reliability, computational feasibility, and interpretability in operational environments remain insufficiently explored. This study presents an explainability-aware empirical evaluation of seven pre-trained convolutional neural network architectures for multi-class IoT DDoS detection using the CICDDoS2019 dataset and an image-based traffic representation. The analysis integrates performance metrics, reliability-oriented statistics (MCC, Youden Index, confidence intervals), latency and training cost assessment, and interpretability evaluation using Grad-CAM and SHAP. Results indicate that DenseNet and MobileNet-based architectures achieve strong detection performance while demonstrating superior reliability and compact, class-consistent attribution patterns. DenseNet169 offers the strongest reliability and interpretability alignment, whereas MobileNetV3 provides an effective latency-accuracy trade-off for fog-level deployment. The findings emphasize the importance of combining performance, reliability, and explainability criteria when selecting deep learning models for IoT DDoS detection.