Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866917417675915264 |
|---|---|
| author | Lima, Yasmin Souza Moreira, Rodrigo Moreira, Larissa F. Rodrigues Carvalho, Tereza Cristina M. de B. Silva, Flávio de Oliveira |
| author_facet | Lima, Yasmin Souza Moreira, Rodrigo Moreira, Larissa F. Rodrigues Carvalho, Tereza Cristina M. de B. Silva, Flávio de Oliveira |
| contents | Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks, yet most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data. We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics: lag-1 autocorrelation of an aggregated flow signal and PCA cumulative explained variance. When the probes are inconclusive, the framework reserves a hybrid option as a future fallback rather than an empirically validated branch. Experiments on two statistically distinct datasets with Isolation Forest, One-Class SVM, and KMeans show that structural features consistently match or outperform temporal ones, with the performance gap widening as temporal dependence weakens. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2604_16575 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic Lima, Yasmin Souza Moreira, Rodrigo Moreira, Larissa F. Rodrigues Carvalho, Tereza Cristina M. de B. Silva, Flávio de Oliveira Machine Learning Artificial Intelligence Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks, yet most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data. We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics: lag-1 autocorrelation of an aggregated flow signal and PCA cumulative explained variance. When the probes are inconclusive, the framework reserves a hybrid option as a future fallback rather than an empirically validated branch. Experiments on two statistically distinct datasets with Isolation Forest, One-Class SVM, and KMeans show that structural features consistently match or outperform temporal ones, with the performance gap widening as temporal dependence weakens. |
| title | Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic |
| topic | Machine Learning Artificial Intelligence |
| url | https://arxiv.org/abs/2604.16575 |