XAI-SDN: An Explainable Entropy-Guided Machine Learning Framework for Real-Time DDoS Detection in Software Defined Networks

Explainability is now feasible for real-time security systems: The framework demonstrates that machine learning models can provide transparency about their decisions (using SHAP) while still operating fast enough for practical network defense, processing nearly 2,000 flows per second with full explanations—showing that "black box" AI is not a necessary trade-off for speed in cybersecurity.

DDoS detection can achieve near-perfect accuracy in controlled settings: The system reached 99.9987% accuracy on the CIC-DDoS2019 benchmark, but this exceptional performance was achieved on a fixed temporal split of historical data, which may not reflect real-world conditions where attack patterns evolve and differ from training data.

Lightweight design enables deployment in resource-constrained networks: By using entropy-based features and a Random Forest classifier, XAI-SDN achieves high performance without requiring computationally expensive deep learning models, making it potentially deployable on network infrastructure with limited processing power.

Transparency mechanisms add meaningful computational overhead: While the system processes 60,000+ flows per second without explanations, adding SHAP-based transparency reduces this to about 2,000 flows per second—a 30-fold slowdown that organizations must weigh against the value of understanding why the system flagged specific traffic as malicious.

Real-world validation remains an open question: The paper tests on a single benchmark dataset with 99.14% DDoS traffic prevalence, which is unusually high compared to typical networks; performance on diverse, real-world network conditions with different attack types remains unclear.