Search for collections on FTS Digilib

Understanding Statistical and Temporal Representations for Large-Scale IoT DDoS Detection Through Ablation-Driven Analysis

Wicaksono, Daniel Nomolas and Setiadi, De Rosal Ignatius Moses and Susanto, Ajib and Harkespan, Imanuel and Mohamed, Mohamad Afendee and Sambas, Aceng (2026) Understanding Statistical and Temporal Representations for Large-Scale IoT DDoS Detection Through Ablation-Driven Analysis. Journal of Computing Theories and Applications, 3 (4). pp. 678-698. ISSN 3024-9104

[thumbnail of 16126-Article Text-57450-1-10-20260529.pdf] Text
16126-Article Text-57450-1-10-20260529.pdf
Available under License Creative Commons Attribution.

Download (1MB)

Abstract

Recent Internet of Things (IoT) intrusion detection studies have reported near-perfect benchmark performance for Distributed Denial of Service (DDoS) detection, yet limited attention has been given to understanding how different traffic representations contribute to the detection process under highly imbalanced traffic conditions. This study presents an ablation-driven analysis to investigate the contribution of statistical and temporal representations for large-scale IoT DDoS detection using the CICIoT2023 dataset. Three experimental scenarios are evaluated, including statistical representation, temporal sequence representation, and hybrid statistical–temporal representation. Temporal representations are learned using a one-dimensional Convolutional Neural Network (1D-CNN) with lag-based traffic sequences, while ensemble tree-based classifiers are employed for final classification and representation analysis. In addition, multiple ablation configurations are designed to evaluate the impact of temporal dependency modeling and feature engineering strategies on detection performance. Experimental results show that statistical traffic representations remain highly effective for DDoS detection on CICIoT2023, achieving 99.36% accuracy and 99.31% weighted F1-score in the statistical representation scenario. Feature importance analysis further indicates that engineered statistical features contribute substantially more to the classification process than CNN-based temporal representations. Although temporal modeling captures sequential traffic behavior, its contribution is relatively limited and mainly acts as a complementary representation. Furthermore, the hybrid configuration produces only marginal improvements over the statistical representation alone. These findings highlight the importance of representation-level analysis for understanding the actual contribution of statistical and temporal modeling in modern IoT intrusion detection systems beyond relying solely on benchmark accuracy.

Item Type: Article
Subjects: Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Depositing User: dl fts
Date Deposited: 29 May 2026 21:54
Last Modified: 29 May 2026 21:54
URI: https://dl.futuretechsci.org/id/eprint/187

Actions (login required)

View Item
View Item