Explainable and Domain-Robust IoT DDoS Detection via Systematic Feature Analysis and SHAP Interpretability

The rapid expansion of Internet of Things (IoT) technologies has intensified security challenges, particularly under the computational, energy, bandwidth, and storage constraints of IoT devices. The heterogeneity of IoT devices, protocols, and operating environments further expands the attack surface, particularly for Distributed Denial of Service (DDoS) attacks. Although machine learning has been widely applied to intrusion detection, benchmark-only evaluation may not adequately reflect benign traffic in real-world operational environments. To address these challenges, this paper presents an intelligent threat detection framework for IoT networks based on systematic feature analysis. The framework combines DDoS attack and benign traffic from CICIoT2023 with real benign traffic captured at the Information Technology Center of the Libyan Academy. A validated 46-feature representation was analyzed using zero-variance removal, Pearson correlation, Mutual Information-based feature ranking, and Spearman correlation-based hierarchical clustering. Five tree-based classifiers, namely Decision Tree, Random Forest, XGBoost, LightGBM, and CatBoost, were evaluated under binary, multiclass, natural-prevalence, and held-out DDoS subtype settings. CatBoost achieved 100.0000% accuracy on the balanced binary test, while Decision Tree with 10 Mutual Information-selected features achieved 99.9965% accuracy with a measured model-only inference latency of approximately 0.030 μs per flow. In multiclass classification, 99.9808% accuracy was maintained using only 10 features. Real benign traffic substantially reduced false positives for several classifiers while preserving or improving performance on the common CICIoT2023 test set. Across five repeated held-out-subtype partitions, LightGBM achieved a mean accuracy of 99.9641%, indicating strong generalization within the evaluated CICIoT2023 behavioral domain. SHAP analysis further identified influential features and feature interactions contributing to detection decisions. Overall, the findings demonstrate that systematic feature analysis, dimensionality reduction, tree-based learning, and real benign-domain validation provide a promising approach for accurate and robust IoT threat detection. Future work will investigate physical edge deployment, temporal or group-based validation, and independent external malicious-traffic evaluation