From Black Box to Firewall: Automating Snort Rules from SHAP Explanations in IoT DDoS Detection

Abstract

With the explosive growth of Internet of Things (IoT) hardware, securing modern networks has become increasingly difficult as they are often the launchpad for massive Distributed Denial of Service (DDoS) campaigns. Security teams have been successful in deploying Machine Learning (ML) classifiers like Random Forests to detect these threats. However, there is a fundamental problem: these models provide zero transparency. Network administrators are not keen to deploy defensive measures based solely on an opaque algorithm’s prediction. Explainable AI (XAI) methods such as SHapley Additive Explanations (SHAP) are able to provide the reasoning behind these models, but at present, they only generate visual graphs for humans to interpret. In this work we go beyond visualisation and develop a fully autonomous defence system. We developed an algorithm that takes local SHAP data and programmatically builds it into functional Snort 3 firewall commands immediately. Our Random Forest engine was able to identify DDoS traffic with 98.2% accuracy on a representative 10,000-flow sample of the CICIoT2023 dataset. Our translation pipeline then parsed the feature weights to produce over 50 executable rules. The dynamic rules have been successful in mitigating 87.4% of the attacks and generating false positives only in 4.3% of the normal traffic. Importantly, the entire parsing and translation process took only 18.4 ms per packet, which makes it very practical for automated defence on real-world networks.

Introduction

The rapid growth of the Internet of Things (IoT) has increased connectivity but also introduced significant security risks due to weak built-in protections in many devices. Attackers exploit these vulnerabilities to create botnets that launch Distributed Denial of Service (DDoS) attacks. Traditional signature-based intrusion detection systems, such as Snort, are effective only against known threats and cannot detect new or evolving attacks. Machine Learning (ML) has improved DDoS detection, but its lack of transparency makes it difficult for security analysts to trust and automate responses.

To address this challenge, the study proposes an end-to-end framework that combines Explainable Artificial Intelligence (XAI) with automated firewall rule generation. Instead of merely displaying SHAP (SHapley Additive exPlanations) values for human interpretation, the framework introduces the SHAPToSnortTranslator, an algorithm that directly converts SHAP explanations into executable Snort 3 firewall rules. The study aims to:

• Build an accurate DDoS detection model using the CICIoT2023 dataset.
• Develop an automated SHAP-to-Snort translation algorithm.
• Evaluate the effectiveness, latency, and false-positive rate of the generated rules.

Related Work

Previous research has successfully applied SHAP and other explainable AI techniques to improve the interpretability of intrusion detection systems. Other studies have attempted to automate firewall rule generation using decision trees or Large Language Models (LLMs). However, these approaches either lack flexibility or suffer from unpredictability and latency. This work fills the research gap by providing a deterministic, algorithmic method for translating SHAP outputs directly into Snort rules.

Methodology

The proposed framework consists of three phases:

1. Data preparation and classification using a Random Forest (RF) classifier.
2. SHAP-based explainability to identify the most influential traffic features for each network flow.
3. Automatic Snort rule generation through the SHAPToSnortTranslator algorithm.

The experiments used a 10,000-sample subset of the CICIoT2023 dataset containing benign traffic and major DDoS attack types (UDP, TCP, and ICMP floods). After preprocessing, an 80:20 training-testing split was applied. The Random Forest model was configured with optimized parameters to balance accuracy and computational efficiency.

Experiments and Evaluation

The framework was implemented using Python 3.10, scikit-learn, and the SHAP library. The generated Snort rules were tested in a simulated network environment and compared with manually written rules from standard repositories. Performance was evaluated using:

• ML metrics: Accuracy, Precision, Recall, and F1-score.
• Firewall metrics: Rule Detection Rate and False Positive Rate.
• Latency: Average and 95th-percentile execution time.

Results

The Random Forest classifier achieved excellent detection performance:

• Accuracy: 98.2%
• Precision: 97.5%
• Recall: 98.8%

The SHAPToSnortTranslator successfully generated more than 50 unique Snort 3 rules. These rules achieved:

• Rule Detection Rate: 87.4%
• False Positive Rate: 4.3%

Compared to manually written Snort rules, which detected 72.1% of attacks, the proposed AI-generated rules significantly improved detection while maintaining a low false-positive rate.

Conclusion

Explainable AI does not have to be a diagnostic tool. In this paper, we constructed a framework which grabs the abstract SHAP-derived mathematical weights and translates them into hardcoded, executable Snort 3 firewall rules. Our random forest classifier tested against a representative subset of the CICIoT2023 dataset and obtained 98.2% accuracy rate for DDoS detection in IoT. More importantly, the translation script generated rules that blocked 87.4% of attacks with hardly any disruption, with a false positive rate of just 4.3%. The latency of 18.4 ms is best of all and shows that dynamic, live AI-authored firewall updates are totally realistic for real world deployment in IoT settings. The next step is to broaden the syntax of the parser to be able to manage deep packet inspection logic.

References

[1] M. A. A. et al., “Classification and Explanation of DDoS using ML + SHAP,” arXiv preprint arXiv:2306.17190, 2023. [Online]. Available: https://arxiv.org/abs/2306.17190 [2] B. B. et al., “Anomaly Detection in IoT with Explainable AI (Iforestexplain),” Scribd, 2023. [Online]. Available: https://www.scribd.com/document/916565133 [3] C. C. et al., “Automated and Explainable DDoS Analysis (TPOT + SHAP),” arXiv preprint arXiv:2511.04114, 2025. [Online]. Available: https://arxiv.org/pdf/2511.04114.pdf [4] D. D. et al., “Systematic Review: XAI in IDS (SHAP/LIME benefits),” PMC, 2024. [Online]. Available: https://pmc.ncbi.nlm.nih.gov/articles/PMC11877648/ [5] E. E. et al., “Explainable XAI for Intelligent IDS (XAI-IDR),” International Journal of Computer Applications, 2023. [Online]. Available: https://www.ijcaonline.org [6] F. F. et al., “Explainable AI-Based Network IDS,” IJARCCE, 2026. [Online]. Available: https://ijarcce.com/IJARCCE.2026.15494 [7] M. Moreno, X. Sáez-de-Cámara, A. Urbieta, and M. Iturbe, “Leveraging LLMs for Automated IDS Rule GENERATION: A Novel Methodology for Securing Industrial Environments,” Ikerlan Technology Research Centre, 2025. [Online]. Available: http://iturbe.info/moreno2025leveraging.pdf [8] A. Coscia, V. Dentamaro, S. Galantucci, A. Maci, and G. Pirlo, “Automatic decision tree-based NIDPS ruleset generation for DoS/DDoS attacks,” Journal of Information Security and Applications, vol. 82, p. 103736, 2024. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2214212624000395 [9] G. G. et al., “Building IDS That Writes Its Own Rules,” YouTube, 2024. [Online]. Available: https://www.youtube.com/watch?v=Xruv3suXfwg [10] H. H. et al., “Evaluation of XAI for Cybersecurity Firewall Systems,” DiVA Portal, 2024. [Online]. Available: https://www.diva-portal.org/smash/get/diva2:1874387/FULLTEXT01.pdf [11] I. I. et al., “DDoS Detection and Mitigation Using AI,” IJEDR, 2026. [Online]. Available: https://rjwave.org/ijedr/IJEDR2601115.pdf [12] Cisco Systems, “SnortML: ML-based Exploit Detection for Snort,” Secure Firewall Docs, 2023. [Online]. Available: https://secure.cisco.com/snortml

Copyright

Copyright © 2026 Aayush Rajbhar, Sunny Nahar. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.