An efficient method for network traffic anomaly detection based on SHAP and deep learning

Zhaohui Fang, Ping Xuan and Hong Ding

PLOS ONE, 2026, vol. 21, issue 8, 1-26

Abstract: To address the critical challenge of Denial-of-Service (DoS) attack detection in wireless sensor networks (WSNs), this study proposes an efficient anomaly detection framework that synergistically integrates SHAP (SHapley Additive exPlanations) for feature interpretation and a deep convolutional neural network (DCNN) with self-attention mechanism. The SHAP algorithm directly selects optimal feature subsets by quantifying feature contributions, eliminating the need for dimensionality reduction. Subsequently, a DCNN model enhanced with self-attention mechanisms learns spatiotemporal patterns from SHAP-refined features, improving discriminative capability for anomaly traffic. Evaluated on the UNSW-NB15 dataset, our model achieves AUROC = 0.999 and AUPRC = 0.992, surpassing state-of-the-art methods (SVM: AUROC = 0.993; XGBoost: AUPRC = 0.988). Ablation studies confirm SHAP improves MCC by 6.1% and attention mechanisms boost DoS detection precision by 3.9%. This work demonstrates that combining interpretable feature selection (SHAP) with attention-driven deep learning significantly enhances detection efficiency and accuracy, providing a viable solution for real-time WSN security.

Date: 2026
References: Add references at CitEc
Citations:

Downloads: (external link)
https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0356069 (text/html)
https://journals.plos.org/plosone/article/file?id= ... 56069&type=printable (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:plo:pone00:0356069

DOI: 10.1371/journal.pone.0356069

Access Statistics for this article

More articles in PLOS ONE from Public Library of Science
Bibliographic data for series maintained by plosone ().