XGBoost model for attack detection, achieving 99.87% accuracy and a 99.61% F1-Score.
Model interpretability techniques identified key predictive features, including
`Destination Port` and `Init_Win_bytes_forward`. Furthermore, a detailed forensic investigation of the
DoS Hulk attack identified its unique signature, which includes an abnormally high `Max Packet Length` (10.53x higher than benign traffic) and `Flow Duration` (5.34x higher). These findings provide a strong, data-driven basis for real-time intrusion detection and incident response.