Explainable Hybrid AI Model for DDoS Detection in SDN-Enabled Internet of Vehicle

The convergence of Software Defined Networking (SDN) in Internet of Vehicles (IoV) enables a flexible, programmable, and globally visible network control architecture across Road Side Units (RSUs), cloud servers, and automobiles. While this integration enhances scalability and safety, it also raises sophisticated cyberthreats, particularly Distributed Denial of Service (DDoS) attacks. Traditional rule-based anomaly detection methods often struggle to detect modern low-and-slow DDoS patterns, thereby leading to higher false positives. To this end, this study proposes an explainable hybrid framework to detect DDoS attacks in SDN-enabled IoV (SDN-IoV). The hybrid framework utilizes a Residual Network (ResNet) to capture spatial correlations and a Bi-Long Short-Term Memory (BiLSTM) to capture both forward and backward temporal dependencies in high-dimensional input patterns. To ensure transparency and trustworthiness, the model integrates the Explainable AI (XAI) technique, i.e., SHapley Additive exPlanations (SHAP). SHAP highlights the contribution of each feature during the decision-making process, facilitating security analysts to understand the rationale behind the attack classification decision. The SDN-IoV environment is created in Mininet-WiFi and SUMO, and the hybrid model is trained on the CICDDoS2019 security dataset. The simulation results reveal the efficacy of the proposed model in terms of standard performance metrics compared to similar baseline methods.