An efficient method for network traffic anomaly detection based on SHAP and deep learning

To address the critical challenge of Denial-of-Service (DoS) attack detection in wireless sensor networks (WSNs), this study proposes an efficient anomaly detection framework that synergistically integrates SHAP (SHapley Additive exPlanations) for feature interpretation and a deep convolutional neural network (DCNN) with self-attention mechanism. The SHAP algorithm directly selects optimal feature subsets by quantifying feature contributions, eliminating the need for dimensionality reduction. Subsequently, a DCNN model enhanced with self-attention mechanisms learns spatiotemporal patterns from SHAP-refined features, improving discriminative capability for anomaly traffic. Evaluated on the UNSW-NB15 dataset, our model achieves AUROC = 0.999 and AUPRC = 0.992, surpassing state-of-the-art methods (SVM: AUROC = 0.993; XGBoost: AUPRC = 0.988). Ablation studies confirm SHAP improves MCC by 6.1% and attention mechanisms boost DoS detection precision by 3.9%. This work demonstrates that combining interpretable feature selection (SHAP) with attention-driven deep learning significantly enhances detection efficiency and accuracy, providing a viable solution for real-time WSN security.