A Framework for Network Traffic–Based DDoS Attack Detection and Explanation - Viola, Roberta; Nogueira, Michele; Veloso, Adriano (Anais do Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), 2026)
This paper presents TRACE-NET, an auditable and governed framework for network traffic-based DDoS attack detection and explanation. TRACE-NET combines a traffic classifier with feature attribution to generate instancelevel explanations grounded in observable flow behavior. A deterministic jury score summarizes the epistemic support of each detection by jointly assessing model confidence and the structure of characteristic attributions, penalizing weak, ambiguous, or single-dominant evidence independently of ground truth. A Large Language Model (LLM) is used strictly as a post-hoc translation layer. Experiments on the CICDDoS2019 dataset show that TRACE-NET reduces explanation risk inflation from 88% to 32%,by anchoring explanations to auditable reliability signals, aligning operational security requirements with emerging regulatory demands for transparent, accountable, and risk-aware AI systems in network security.