Auditable Flood Attack Detection using Isolation Forest with Decision Predicate Graphs - Pereira, Eron Ponce; Zarpelão, Bruno Bogaz; Barbon Junior, Sylvio (Anais do Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), 2026)
In computer networks, anomaly alerts are frequent, but there is an explainability gap between an anomaly alert and the observable network evidence needed for triage and incident reporting. We evaluate Isolation Forest on CICIoT2023 IoT traffic for DoS/DDoS flood attacks and interpret the learned trees with Decision Predicate Graphs (DPGs). Using fixed benign baselines, we test a Single, Dual, and Triple Attack Scenario while sweeping the attack fraction rate. We report precision, recall, F1 and error rates on fixed test sets, and use DPG predicates and co-occurrence relations to trace how network flows become outliers, turning model decisions into auditable network-level conditions that remain interpretable under mixed attacks and contaminated training.