Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic

• URL: http://arxiv.org/abs/2604.16575v1
• Date: Fri, 17 Apr 2026 12:59:48 GMT
• Title: Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic
• Abstract summary: Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks.<n>Most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data.<n>We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics.
• Score: 0.046603287532620725
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks, yet most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data. We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics: lag-1 autocorrelation of an aggregated flow signal and PCA cumulative explained variance. When the probes are inconclusive, the framework reserves a hybrid option as a future fallback rather than an empirically validated branch. Experiments on two statistically distinct datasets with Isolation Forest, One-Class SVM, and KMeans show that structural features consistently match or outperform temporal ones, with the performance gap widening as temporal dependence weakens.

Related papers

• Online Test-Time Adaptation for Generalizable Dynamic Graph Anomaly Detection [49.23479407739726]
  Generalizable dynamic graph anomaly detection (DGAD) enables pretrained detectors to identify anomalies in unseen target domains without costly retraining.<n>We formulate online test-time adaptation for generalizable DGAD and propose OTTA-DGAD.<n> OTTA-DGAD first extracts dynamic prototypes, i.e., evolving representations of normal and anomalous patterns, from temporal ego-graphs and stores them in a memory buffer.<n>An anomaly scorer then compares incoming edge representations against these prototypes to identify both general and domain-specific anomalies.
  arXiv  Detail & Related papers  (2026-08-20T10:07:39Z)
• On the Adversarial Robustness of Remote Sensing Semantic Change Detection [19.4097466391406]
  Semantic change detection (SCD) is a bitemporal dense-prediction task that jointly identifies changed regions and their semantic states before and after change.<n>We present a task-specific evaluation framework that separates output-side attack objectives from input-side temporal perturbation access.<n>Experiments show that final semantic-change predictions can be severely corrupted even when binary change localization remains comparatively stable.
  arXiv  Detail & Related papers  (2026-08-15T15:02:42Z)
• Back to Source: Open-Set Continual Test-Time Adaptation via Domain Compensation [18.70132691409063]
  Test-Time Adaptation aims to mitigate distributional shifts between training and test domains during inference time.<n>The coupling of domain and semantic shifts often collapses the feature space, severely degrading both classification and out-of-distribution detection.<n>We propose DOmain COmpensation (DOCO), a lightweight and effective framework that robustly performs domain adaptation and OOD detection in a synergistic, closed loop.
  arXiv  Detail & Related papers  (2026-04-23T15:29:29Z)
• Surprised by Attention: Predictable Query Dynamics for Time Series Anomaly Detection [1.7751300245073598]
  AxonAD is an unsupervised detector that treats multi-head attention query evolution as a short horizon predictable process.<n>A tail-aggregated query mismatch score measures cosine deviation between predicted and target queries on recent timesteps.<n>On in-vehicle telemetry with interval annotations, AxonAD improves ranking quality and temporal localization over strong baselines.
  arXiv  Detail & Related papers  (2026-03-13T11:40:51Z)
• Real-Time Proactive Anomaly Detection via Forward and Backward Forecast Modeling [0.0]
  We introduce two proactive anomaly detection frameworks: the Forward Forecasting Model (FFM) and the Backward Reconstruction Model (BRM)<n>FFM forecasts future sequences to anticipate disruptions, while BRM reconstructs recent history from future context to uncover early precursors.<n>Our models support both continuous and discrete multivariate features, enabling robust performance in real-world settings.
  arXiv  Detail & Related papers  (2026-02-12T03:57:41Z)
• ARES: Anomaly Recognition Model For Edge Streams [15.767494189633133]
  We introduce ARES, an unsupervised anomaly detection framework for edge streams.<n> ARES combines Graph Neural Networks (GNNs) for feature extraction with Half-Space Trees (HST) for anomaly scoring.<n>GNNs capture both spike and burst anomalous behaviors within streams by embedding node and edge properties in a latent space, while HST partitions this space to isolate anomalies efficiently.
  arXiv  Detail & Related papers  (2025-11-27T03:56:35Z)
• Morphing Through Time: Diffusion-Based Bridging of Temporal Gaps for Robust Alignment in Change Detection [51.56484100374058]
  We introduce a modular pipeline that improves spatial and temporal robustness without altering existing change detection networks.<n>A diffusion module synthesizes intermediate morphing frames that bridge large appearance gaps, enabling RoMa to estimate stepwise correspondences.<n>Experiments on LEVIR-CD, WHU-CD, and DSIFN-CD show consistent gains in both registration accuracy and downstream change detection.
  arXiv  Detail & Related papers  (2025-11-11T08:40:28Z)
• A theoretical framework for self-supervised contrastive learning for continuous dependent data [79.62732169706054]
  Self-supervised learning (SSL) has emerged as a powerful approach to learning representations, particularly in the field of computer vision.<n>We propose a novel theoretical framework for contrastive SSL tailored to emphsemantic independence between samples.<n>Specifically, we outperform TS2Vec on the standard UEA and UCR benchmarks, with accuracy improvements of $4.17$% and $2.08$%, respectively.
  arXiv  Detail & Related papers  (2025-06-11T14:23:47Z)
• Multiresolution Analysis and Statistical Thresholding on Dynamic Networks [49.09073800467438]
  ANIE (Adaptive Network Intensity Estimation) is a multi-resolution framework designed to automatically identify the time scales at which network structure evolves.<n>We show that ANIE adapts to the appropriate time resolution and is able to capture sharp structural changes while remaining robust to noise.
  arXiv  Detail & Related papers  (2025-06-01T22:55:55Z)
• PeFAD: A Parameter-Efficient Federated Framework for Time Series Anomaly Detection [51.20479454379662]
  We propose a. Federated Anomaly Detection framework named PeFAD with the increasing privacy concerns. We conduct extensive evaluations on four real datasets, where PeFAD outperforms existing state-of-the-art baselines by up to 28.74%.
  arXiv  Detail & Related papers  (2024-06-04T13:51:08Z)
• Imbalanced Aircraft Data Anomaly Detection [103.01418862972564]
  Anomaly detection in temporal data from sensors under aviation scenarios is a practical but challenging task. We propose a Graphical Temporal Data Analysis framework. It consists three modules, named Series-to-Image (S2I), Cluster-based Resampling Approach using Euclidean Distance (CRD) and Variance-Based Loss (VBL)
  arXiv  Detail & Related papers  (2023-05-17T09:37:07Z)
• Efficient pattern-based anomaly detection in a network of multivariate devices [0.17188280334580192]
  We propose a scalable approach to detect anomalies using a two-step approach. First, we recover relations between entities in the network, since relations are often dynamic in nature and caused by an unknown underlying process. Next, we report anomalies based on an embedding of sequential patterns.
  arXiv  Detail & Related papers  (2023-05-07T16:05:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.