Authors: Gawade Ishwari Shyam, Professor Bangar Abhishek P., Professor Karad Vandana A.
Abstract: Flooding-type attacks (DoS and DDoS) keep threatening network services and IoT infrastructure. Modern deeplearning intrusion detectors score above 99 % on public benchmarks, yet practitioners still face four obstacles: models cannot justify their alerts, rare attack classes are under-learned, tuning is costly, and small crafted perturbations can defeat the classifier. We examine 26 publications, of which five recent studies (2023–2026) form the core and 21 provide background, and group them into six themes: handling of imbalanced data, deep classifiers, optimisation, explanation techniques, efficient and trustworthy explanation, and adversarial resilience. Across the core studies, GAN-based balancing with attention networks reports 99.95–99.99 % accuracy on five datasets, but the gap to the best competing methods is a few tenths of a point at most. Selecting features by combining ANOVA and SHAP shrinks the input by roughly 70 % and shortens LIME run time by up to 87 %. Using SHAP to prune harmful inputs lowered missed detections by 26 % and 92 % on two DDoS sets. Recurrent detectors that reach about 96 % on clean data fall to 51–61 % under FGSM at ε = 0.1, and changes in SHAP attributions can serve as a partial warning signal (ROC-AUC 0.70–0.88). Evidence is mostly offline and limited to one dataset, the most accurate model was never attacked in testing, and no shared measure of explanation quality exists. We offer a thematic synthesis, a thirteen-study comparison, a conceptual seven-layer design and a prioritised agenda for future work.
