Understanding Statistical and Temporal Representations for Large-Scale IoT DDoS Detection Through Ablation-Driven Analysis

Recent Internet of Things (IoT) intrusion detection studies have reported near-perfect benchmark performance for Distributed Denial of Service (DDoS) detection, yet limited attention has been given to understanding how different traffic representations contribute to the detection process under highly imbalanced traffic conditions. This study presents an ablation-driven analysis to investigate the contribution of statistical and temporal representations for large-scale IoT DDoS detection using the CICIoT2023 dataset. Three experimental scenarios are evaluated, including statistical representation, temporal sequence representation, and hybrid statistical–temporal representation. Temporal representations are learned using a one-dimensional Convolutional Neural Network (1D-CNN) with lag-based traffic sequences, while ensemble tree-based classifiers are employed for final classification and representation analysis. In addition, multiple ablation configurations are designed to evaluate the impact of temporal dependency modeling and feature engineering strategies on detection performance. Experimental results show that statistical traffic representations remain highly effective for DDoS detection on CICIoT2023, achieving 99.36% accuracy and 99.31% weighted F1-score in the statistical representation scenario. Feature importance analysis further indicates that engineered statistical features contribute substantially more to the classification process than CNN-based temporal representations. Although temporal modeling captures sequential traffic behavior, its contribution is relatively limited and mainly acts as a complementary representation. Furthermore, the hybrid configuration produces only marginal improvements over the statistical representation alone. These findings highlight the importance of representation-level analysis for understanding the actual contribution of statistical and temporal modeling in modern IoT intrusion detection systems beyond relying solely on benchmark accuracy.