Per-Attack-Type Evidence Aggregation for Interpreting Multi-Agent Ddos Detection

Abstract

Multi-agent Distributed Denial-of-Service (DDoS) detection decomposes the decision-making process into a supervised classification agent, an anomaly detection agent, a normal-behavior or baseline-deviation agent, and a transparent rule-based evidence agent. The outputs of these agents are subsequently integrated by an evidence-fusion agent to yield a unified risk score and discrete risk level. While this architectural approach enhances modularity and interpretability, it poses a pivotal evaluation challenge: for each attack category, which detector provides the primary discriminative signal, and how does evidence fusion reconcile partial or conflicting evidence? This paper introduces a per-attack-type evidence aggregation methodology, accompanied by an analyst console visualization. For each analysis window, five normalized signals are retained: classification probability, anomaly score, baseline-deviation score, rule-evidence score, and fused risk. Records are grouped by scenario, and empirical means, dispersion statistics, peak risk, and maximum ordinal risk levels are computed for SYN, UDP, HTTP, amplification, and benign reference scenarios. The resulting visualization elucidates detector complementarity, disagreement, and the consistency of evidence fusion across the attack taxonomy. This methodology is explicitly diagnostic and not intended as a replacement for accuracy-based evaluation; it is used in conjunction with per-class precision, recall, F1 score, confusion matrices, cross-dataset validation, and agent ablation experiments. The principal contribution is an analyst-centered methodology for interpreting multi-agent DDoS detection outcomes, while rigorously controlling for alert-selection bias, target leakage, imbalanced sample counts, and intra-class variability.