Tanchun: Robust Flow-Based HTTP(S) DDoS Detection via Behavioral Attribute Guidance

Tanchun: Robust Flow-Based HTTP(S) DDoS Detection via Behavioral Attribute Guidance Qingyang Li∗

Yunpeng Tan∗ Mingxin Yang∗ Yannan Hu† Zongming Guo∗ Xinggong Zhang∗

arXiv:2610.18406v1 [cs.NI] 13 Oct 2026

∗ Peking University

† Zhongguancun Laboratory

Abstract

Yong Cui‡

‡ Tsinghua University

prevalent, accounting for 63.65% of application-layer DDoS attacks [10]. The growing attack scale and prevalence of encryption make scalable detection increasingly challenging. Flow-based detection offers a promising solution due to its decryption-free operation and scalability. Flow data, readily available from widely deployed telemetry systems [7, 23, 26], abstracts massive packet-level communications into compact five-tuple-based statistics without decrypting payloads. Unlike commercial web application firewalls (WAFs) [8], which require HTTPS decryption for content inspection, flow-based detection avoids decryption overhead and reduces privacy concerns in sensitive services. It also incurs lower processing costs [17] than traffic-analysis methods that rely on per-packet inspection or feature extraction [12, 17, 27], making it better suited for deployment in high-speed networks. Despite these advantages, leveraging flow data for HTTP(S) DDoS detection remains challenging due to two fundamental issues: coarse-grained flow statistics and traffic drift. Coarse-Grained Flow Statistics. Flow data typically provides only coarse-grained statistics, such as byte and packet counts. Attackers can issue legitimate-looking requests and generate low-volume flows that closely resemble benign traffic [31], thereby diminishing the discriminative capability of individual flows for detection. This limitation motivates us to aggregate flows sharing the same IP-pair (i.e., a source IP and a destination IP) to capture client-server access patterns from a more holistic perspective. While individual flows can appear indistinguishable from benign traffic, aggregated IPpair traffic patterns may reveal distinctive characteristics that differentiate attackers from legitimate users [13, 17]. Traffic Drift. Although existing IP-pair-level analysis methods have achieved strong performance [13, 17], their IP-pair feature extraction mechanisms still face substantial challenges in the presence of traffic drift. In real-world networks, traffic distributions continuously evolve due to changes in benign user behaviors and attacker strategies. Existing approaches typically characterize IP-pairs using numerical features, such as flow counts, packet/byte volumes [17]. However, these numerical features are sensitive to traffic drift and may

HTTP(S) DDoS attacks have surged in frequency and scale, posing a significant threat to network security. Flow-based detection is a promising solution for large-scale HTTP(S) DDoS detection due to its decryption-free operation and scalability. However, the coarse-grained numerical statistics in flow data limit accurate attack detection and lack robustness when benign and attack traffic patterns drift over time. In this paper, we present Tanchun, a drift-aware flowbased HTTP(S) DDoS detection system that relies solely on decryption-free flow data. Specifically, Tanchun groups flows by IP-pair and aggregates them over consecutive time slots into behavior sequences, capturing temporal access patterns to compensate for the limited information in individual flows. It further abstracts these sequences into human-understandable behavioral attributes that capture stable behavioral semantics. Tanchun then aligns behavior sequences with their corresponding behavioral attributes to guide representation learning, enabling robust detection under traffic drift. We evaluate Tanchun across diverse HTTP(S) DDoS scenarios. Tanchun achieves the best overall performance, with an average F1-score of 0.988, and outperforms the secondbest method by 5.3% and 9.6% under benign-traffic and attacktraffic drift, respectively. Experiments on real-world traffic traces further demonstrate its practical effectiveness.

1

Lei Zhang†

Introduction

HTTP(S) DDoS attacks have become a critical threat to modern networks. Unlike volumetric DDoS attacks that primarily exhaust network bandwidth, HTTP(S) DDoS attacks overwhelm application-layer services with massive HTTP or HTTPS requests, consuming server-side resources and degrading service availability. Such attacks continue to grow in both frequency and intensity. For example, Cloudflare reported a 118% year-over-year increase in HTTP flood attacks in Q1 2025, with rates reaching millions of requests per second [9]. Meanwhile, HTTPS-based attacks have become increasingly 1

• Behavior Sequence Abstraction. To address TC 1, it groups flows by IP-pair and aggregates flows within each consecutive time slot to extract diverse statistical features. The slot-level features are then concatenated into behavior sequences, capturing the temporal access dynamics of each IP-pair. • Behavioral Attribute Derivation. To address TC 2, it first defines some attribute types that describe IP-pair access behavior from different perspectives and their corresponding quantifiable indicators, and then derives behavioral attributes by mapping numerical behavior sequences to different attribute levels. • Semantic-Guided Representation Learning. To address TC 3, it jointly leverages behavioral attributes and behavior sequences. It learns behavior-aware representations by aligning behavior sequences with their corresponding attributes, encouraging IP-pair representations with the same attributes to be close while preserving fine-grained temporal information for detection. We prototype Tanchun and evaluate it across diverse HTTP(S) DDoS scenarios. Tanchun achieves the best overall performance across public datasets, synthetic complex attack scenarios, and diverse traffic-drift settings, with an average F1-score of 0.988. In particular, Tanchun outperforms the second-best method by 5.3% and 9.6% under benign-traffic and attack-traffic drift, respectively. Comprehensive ablation studies and parameter analyses further validate the effectiveness of its key design choices, while evaluations on real-world traffic traces demonstrate its practical detection capability.

deviate from the patterns observed in training data, thereby degrading detection performance and robustness [45]. To overcome this limitation, we aim to find a way to characterize high-level access behaviors and capture stable behavioral semantics that are more robust to traffic drift. Our key insight is that, while numerical IP-pair features may change over time, high-level access behavior may remain stable and can be described by human-understandable behavioral attributes. For example, HTTP(S) DDoS generated by different automated tools may exhibit different traffic characteristics, yet security operators may characterize their per-bot access behaviors with the same behavioral attributes, such as "high-intensity" and "regular" access patterns. Therefore, leveraging such stable behavioral attributes to construct semantic representations of IP-pair access behavior provides a promising direction for robust detection under traffic drift. In this paper, we present Tanchun1 , a drift-aware flowbased HTTP(S) DDoS detection system that relies solely on decryption-free flow data. Tanchun learns stable semantics of IP-pair access behaviors through human-understandable behavioral attributes. Specifically, it first aggregates individual flows into numerical IP-pair features to characterize client– server access patterns. It then describes each IP-pair’s access behavior using human-understandable behavioral attributes and leverages these attributes to guide a deep learning model in capturing high-level behavioral semantics for robust attack detection under traffic drift. However, realizing this goal is non-trivial and requires addressing three main technical challenges (TCs). TC 1: How can flows be aggregated to capture the temporal access behavior of IP-pairs? Client-server access behavior naturally evolves over time, and may generate multiple flows. However, individual flow records provide limited observations, while naive aggregation over a whole observation window like existing works [17] removes temporal ordering and obscures behavioral dynamics. TC 2: How can behavioral attributes be defined and leveraged to characterize diverse access behaviors? Access behaviors exhibit diverse patterns, making it challenging to design behavioral attributes that are sufficiently comprehensive while remaining discriminative. Moreover, mapping numerical IP-pair features to behavioral attributes is challenging due to the lack of explicit quantitative criteria. TC 3: How can the model learn robust behavioral semantics while preserving malicious-benign discrimination? Behavioral attributes provide stable semantic abstraction but may lose fine-grained information for distinguishing malicious and benign traffic, while numerical IP-pair features preserve detailed patterns but are sensitive to traffic drift. To address these technical challenges, we develop Tanchun with three key contributions:

2 2.1

Background and Motivation Threat Model

In this paper, we focus on HTTP(S) DDoS attacks, which overwhelm server-side resources by generating excessive HTTP(S) requests rather than exhausting network bandwidth as volumetric DDoS attacks do [31]. These attacks generally fall into two categories [6]: HTTP(S) floods, which consume service resources through massive requests, and slow attacks (e.g., Slowloris), which exhaust connection resources by maintaining numerous persistent HTTP(S) connections. We assume that attackers control a set of bots to launch HTTP(S) DDoS attacks against target services. Single-bot attacks are treated as a special case and are not distinguished in terminology. Attackers may employ different tools, resulting in diverse request rates, temporal patterns, and resource demands. We assume that attackers attempt to conceal their malicious behavior by keeping individual attack flows lowvolume and benign-like, as also observed in our real-world traces (§ 2.3). Highly multiplexed attacks [1] may expose stronger per-flow characteristics and are therefore outside the primary scope of this work. Attackers may further evade detection by varying the number of bots or reducing per-bot

1 Tanchun is a perceptive girl in the classical novel Dream of the Red

Chamber, and she recognizes the looming threat within the family.

2

0.5 Within benign Benign vs. attack 0.0 0

1

2

3

4

5

Euclidean distance

Figure 1: HTTP(S) DDoS flows confused with benign flows.

Figure 2: Distances between benign and attack IP-pair features.

request rates to mimic benign users. We refer to distributed attacks with low per-bot request rates as low-rate attacks [10].

2.2

100

94.5%

80

63.5%

60 40 20 0 Benign drift

Attack drift

Figure 3: Matching ratios for four attributes under traffic drift.

collected from the production DDoS scrubber of a top-tier ICT vendor [18], whose authenticity is validated by security operators. Since DDoS scrubbers only retain anomalous traffic for mitigation, benign flows from the same environment are unavailable. Therefore, we use HTTP(S) traces from the MAWI dataset [21] (January 2024) as benign references, containing flows generated by diverse users under realistic network conditions. We extract flow features from both attack and benign traces and visualize them using t-SNE. As shown in Fig. 1, HTTP(S) DDoS and benign flows are highly entangled in the feature space, making them difficult to distinguish based solely on flow features. Similar limitations of flow-level features have also been reported by prior studies [11]. This is mainly because HTTP(S) DDoS attacks can exploit legitimate requests while maintaining low perflow volume [31], causing attack flows to resemble benign flows. Therefore, relying solely on individual-flow analysis is insufficient for accurate HTTP(S) DDoS detection.

Flow-based Detection System

HTTP(S) DDoS detection systems should achieve both high accuracy and scalability. Commercial solutions such as WAFs [8] inspect packet contents but require HTTPS decryption, incurring significant decryption overhead [10] and privacy concerns in sensitive domains such as financial services. Traffic-based approaches avoid payload inspection by analyzing traffic patterns [35]; however, many require perpacket processing [12, 27], which remains computationally expensive [17] and limits scalability when processing aggregate HTTP(S) traffic on high-speed links. Flow-based detection provides a scalable alternative with two key advantages. First, flow telemetry is widely supported by existing network infrastructures, including routers (e.g., NetFlow [7] and IPFIX [14]), cloud networks (e.g., NSG and VPC) [26], and other network monitoring systems [23, 37]. Second, flow data enables efficient and privacy-preserving detection. By aggregating massive packets into compact fivetuple (srcIP, dstIP, srcPort, dstPort, protocol) level statistics, flow data avoids payload inspection and significantly reduces processing overhead compared with per-packet analysis [17]. System Model. Leveraging the scalability of flow-based detection, our system detects HTTP(S) DDoS attacks using flow data. A flow collector deployed at the gateway of the protected server cluster captures inbound traffic and extracts flow records for the detector. The detector analyzes flows targeting the HTTP(S) service ports exposed by the protected servers and identifies attack flows. The detection results can then trigger mitigation mechanisms such as IP blocking and FlowSpec. Since existing flow telemetry systems typically expose only limited fields, including flow start time, packet counts, byte counts, and duration [7, 14], our system relies solely on these commonly available features.

2.3

≥ 3 matches (%)

CDF

1.0

2.4

From Flows to IP-Pair Analysis

Although individual flow features of attack and benign traffic may appear similar, their aggregated client–server interaction behaviors can be more distinguishable. Recent studies [13,17] therefore group flows by IP pairs (i.e., source and destination IPs) and extract aggregated features to characterize access behaviors. For example, NetVigil [17] uses statistical features such as flow counts and byte volumes, while HyperVision [13] aggregates small flows as edges for graph-based detection. Benefit of IP-Pair Aggregation. IP-pair aggregation provides a natural way to characterize HTTP(S) DDoS behaviors by capturing client–server access patterns beyond individual flows. To examine this effect, we analyze the traces described in § 2.3 by grouping flows into IP-pairs and extracting four features: flow count, byte count, packet count, and the standard deviation of per-flow byte counts, following existing studies [17]. After feature standardization, we calculate distances among benign IP-pairs and between benign and attack IP-pairs. Fig. 2 presents the cumulative distribution functions (CDFs). As shown, benign–attack IP-pair distances are significantly larger than benign IP-pair distances, indicating that IP-pair aggregation reveals more discriminative behavioral patterns. This observation motivates modeling IP-pair access

Limited Flow Discriminability

However, flow-level features are often too coarse-grained to accurately characterize HTTP(S) DDoS. To demonstrate this limitation, we analyze five real-world HTTP(S) DDoS traces 3

behaviors rather than relying solely on individual flows. Challenges Under Traffic Drifts. However, IP-pair aggregation can be affected by traffic drifts commonly observed in real-world networks. Benign access patterns naturally evolve over time, while attackers continuously adjust their strategies to evade detection, causing numerical IP-pair features to vary across conditions. To quantify this impact, we analyze two benign HTTP(S) traces collected one week apart (January 1 and January 8, 2024) [21] and two real-world attack traces representing HTTP and HTTPS floods. We measured the relative changes in IP-pair features, as shown in Table 1. As shown, both benign and attack traffic evolution can introduce substantial drifts in IP-pair features. The average relative changes reach 34.01% for benign IP-pairs and 227.16% for attack IP-pairs, indicating significant variations across traffic conditions. Since existing approaches typically rely on numerical IP-pair features as model inputs, such variations introduce distribution drift between training and detection data, potentially degrading detection robustness [45].

low) using percentile-based thresholds obtained from benign traffic, and the same thresholds are consistently applied across all traces. As shown in Fig. 3, these attributes remain robust under traffic drifts: 94.5% of benign comparisons and 63.5% of attack comparisons preserve at least three consistent attributes. Even with substantial changes in attack vectors (e.g., HTTP floods to HTTPS floods), the attributes maintain meaningful consistency, demonstrating their potential for robust IP-pair behavior modeling under traffic drifts.

2.6

Based on the above observations, we derive the following insight: robust HTTP(S) DDoS detection under traffic drift requires modeling the stable semantics of IP-pair access behaviors rather than relying solely on numerical features. Behavioral attributes offer a promising representation, as they may capture stable behavioral characteristics despite variations in numerical features under traffic drift. However, incorporating this insight into a practical system is non-trivial, and we face three key technical challenges: TC 1: How can flows be aggregated to capture the temporal access behavior of IP-pairs? Client–server access naturally evolves over time and may generate multiple flows with diverse temporal characteristics. Existing approaches typically aggregate flows within an observation window to extract statistical features [13,17]. However, such aggregation removes the temporal ordering among flows and may obscure important behavioral dynamics, limiting the ability to capture the evolving access behaviors of IP pairs. TC 2: How can behavioral attributes be defined and leveraged to characterize diverse access behaviors? Access behaviors exhibit substantial diversity across users and attack strategies, making it challenging to design attributes that provide sufficient coverage while preserving discriminative capability. Poorly designed attributes may miss critical behavioral patterns or fail to distinguish malicious access from benign activities. Although our preliminary analysis (§ 2.5) demonstrates the potential of behavioral attributes under traffic drifts, it considers only a limited set of attributes and cannot capture the full diversity of real-world behaviors. Moreover, behavioral attributes are high-level semantic abstractions without predefined quantitative mappings, making their derivation from numerical IP-pair features non-trivial. TC 3: How can the model learn robust behavioral semantics while preserving malicious-benign discrimination? Behavioral attributes abstract IP-pair access behaviors and are therefore more robust to traffic drifts. However, this abstraction may discard fine-grained information that is critical for accurate classification. In contrast, numerical IP-pair features retain detailed traffic characteristics that facilitate malicious-benign discrimination, but are more susceptible to traffic drifts. The key challenge is thus to learn representations that capture stable behavioral semantics while preserving the

Table 1: Relative changes in numerical IP-pair features under benign and attack traffic drift. Drift type

Flow count

Bytes

Benign drift Attack drift

69.77% 344.22%

16.83% 14.31% 459.21% 6.84%

Packets Flow std

Key Insight and Technical Challenges

Mean

35.13% 34.01% 98.39% 227.16%

2.5 Behavioral Attributes for Stable Semantics To mitigate the drift issue, we aim to derive a robust representation of IP-pair access behaviors beyond numerical features. Our Intuition. Although traffic drifts may alter numerical IP-pair features, the underlying access behaviors can remain consistent. For example, HTTP(S) DDoS attacks launched with different automated tools may exhibit diverse traffic volumes and temporal patterns. However, they may still exhibit consistent malicious behaviors that security experts can describe using human-understandable attributes, such as "highintensity" and "regular" per-bot access patterns. This motivates us to explore behavioral attributes as a more stable representation of IP-pair access behaviors beyond numerical features. Inspired by attribute-based representations in computer vision, where visual attributes have been leveraged to improve generalization to unseen image classes [2, 43], we investigate behavioral attributes for robust HTTP(S) DDoS detection under traffic drifts. Observation. To preliminarily evaluate the stability of behavioral attributes under traffic drifts, we transform the four IP-pair features introduced in § 2.4 into coarse-grained attributes. Specifically, we derive three "access intensity" attributes from flow, packet, and byte volumes, and one "access diversity" attribute from flow-size variations. Each feature is mapped to one of three attribute levels (high, medium, and 4

Training-only Pipeline

Traffic

Attribute Definition

Level Assignment

2. Behavioral Attribute Derivation

Attribute Type Intensity Continuity Regularity ⋮

3. Attribute-Guided Representation Learning Alignment Loss 𝐿𝑎𝑙𝑖𝑔𝑛

BS1 BS2 … BSn High High Mid ⋮

Low … Mid Low … High Low … High ⋮ ⋮

Attribute Anchor Projected Repr.

Classification Loss 𝐿𝑐𝑙𝑠

Behavior Attributes of each BS Flow Collector

Projection Shared Detection Pipeline

1. Behavior Sequence Abstraction

…

BS1

BS2

BSn

Behavior Representation

Classifier

Flows

Temporal Aggregation

1D-CNN Encoder

Group by IP-Pair

BENIGN/ ATTACK

Behavior Sequences (BS)

Figure 4: The overall architecture and workflow of Tanchun. discriminative information encoded in numerical features.

For each IP-pair Group by IP-Pair

3 3.1

Flows

The Design of Tanchun

Sort by Time-slot Start Time Assignment

Time-slot Per-slot Feature Agg Aggregation

Temporal Aggregation

Multivariate (𝑑dim) time series:

T slots 𝑋 = 𝑥1 , 𝑥2 , … , 𝑥 𝑇 , 𝑋 ∈ 𝑅 𝑇×𝑑 Behavior Sequences

Figure 5: Pipeline of Behavior Sequence Abstraction

Overview

In this paper, we present Tanchun, a flow-based HTTP(S) DDoS detection system that learns robust semantics of IP-pair access behaviors through human-understandable behavioral attributes. The overall architecture and workflow of Tanchun are illustrated in Fig. 4. Specifically, we design the following modules to address the challenges introduced in §2.6: Behavior Sequence Abstraction (§3.2). This module is designed for TC 1 to transform individual flow records into multivariate time series, termed behavior sequences, which characterize the temporal patterns of IP-pair access behavior. Specifically, flows associated with each IP-pair are grouped into consecutive time slots, from which a diverse set of statistical features is extracted. The resulting slot-level feature vectors are then chronologically concatenated to form a multivariate behavior sequence for model training and detection. Behavioral Attribute Derivation (§ 3.3). This module is designed for TC 2 to describe behavior sequences using human-understandable behavioral attributes. Specifically, it defines seven attribute types based on domain knowledge of HTTP(S) DDoS, providing a comprehensive characterization of IP-pair access behaviors while capturing key differences between benign and attack IP-pairs. It further introduces quantitative indicators for each attribute type, derived from behavior sequences and mapped into three levels, i.e., High, Medium, and Low. Finally, each behavioral attribute is represented as a combination of an attribute type and its corresponding level. Attribute-Guided Representation Learning (§ 3.4). This module is designed for TC 3 by leveraging behavioral attributes as semantic supervision to refine behavior sequence representations. Specifically, it designs two complementary learning tasks: attribute alignment and binary classification. The former aligns behavior sequence representations with

their corresponding behavioral attributes, enabling the model to learn transferable representations of typical behavioral patterns. The latter preserves fine-grained discriminative information for attack detection. By jointly optimizing these tasks, Tanchun learns robust behavior representations with improved robustness and detection accuracy.

3.2

Behavior Sequence Abstraction

We propose Behavior Sequence Abstraction (BSA) to transform flow data into time series that capture the temporal access behaviors of IP-pairs. Our key idea is that individual flows only provide instantaneous summaries of client–server interactions, while aggregating flows over consecutive time slots can reveal the evolution of access behaviors over time. BSA first groups flows by IP pairs and then performs Temporal Aggregation to convert the flows associated with each IP-pair into a multivariate time series, referred to as a behavior sequence. The pipeline of BSA is illustrated in Figure 5. Specifically, Temporal Aggregation consists of two steps: time-slot assignment and per-slot aggregation. Step 1. Time-slot Assignment. The start timestamp of each flow indicates when the corresponding communication begins. Therefore, BSA uses flow start times to organize flows along the temporal dimension. Specifically, for each IP-pair, we divide the observation period into consecutive ∆t-second time slots and assign flows whose start times fall within the same time slot to the corresponding interval. Step 2. Per-slot Aggregation. Flows within the same time slot provide aggregated information about the access behavior of an IP-pair during that interval. Therefore, BSA aggregates 5

Table 2: The aggregated features in each time slot. Attribute Type

Features

Description

N ∑ Packets, ∑ Bytes µPkt , µByt σPkt , σByt MinPkt , MinByt MaxPkt , MaxByt

Number of flows Total number of packets/bytes Mean packets/bytes per flow Std. dev. of packets/bytes per flow Minimum packets/bytes per flow Maximum packets/bytes per flow

Level

Compute PerType Indicators

Level Assignment Indicator-Based Behavior Sequences (BS) Level Assignment …

Attribute BS1 Type Intensity High Continuity High Regularity Mid ⋮ ⋮

BS2

… BSn

Low Low Low ⋮

… Mid … High … High ⋮

Attributes of each BS

Figure 6: Pipeline of Behavioral Attribute Derivation.

the flows in each time slot into a d-dimensional feature vector using the statistical features listed in Table 2. Specifically, the number of flows N captures the access frequency, while ∑ Packets and ∑ Bytes capture the overall traffic volume. The mean, std, min, and max values capture the size distribution and heterogeneity of individual flows. For time slots containing no flows, all aggregated features are set to zero. After temporal aggregation, BSA concatenates L consecutive time-slot features into a multivariate time series Xi ∈ RL×d , forming the i-th behavior sequence. Such behavior sequences characterize the temporal evolution of IP-pair access.

3.3

Attribute Definition Intensity Continuity Regularity… High/Medium/Low

tent activity. In contrast, automated bots often sustain request generation during attacks, leading to longer active periods with fewer idle interruptions [24]. We therefore define Activity Persistence and Activity Continuity to capture these two aspects of access activity. (3) Temporal Dynamics. Benign access is driven by changing user demands and interactions, resulting in variations in request timing and access rates. In contrast, script-controlled bots may follow more predefined temporal patterns [36]. We therefore define two attribute types, Temporal Regularity and Access Rate Stability, to characterize the regularity of request timing and the stability of access rates over time. (4) Flow Consistency. Benign users may access diverse resources according to individual interests, resulting in heterogeneous flows. In contrast, bots may repeatedly request the same or similar resources according to attack configurations [36], which can lead to more consistent packet-count and byte-volume characteristics across flows. We therefore define Packet-Count Consistency and Byte-Volume Consistency to capture these two aspects of flow-level consistency. Overall, these four perspectives yield seven attribute types, as summarized in Table 3. Quantitative Indicator. Given the defined attribute types, we next determine their corresponding levels for each behavior sequence. Since these attribute types represent high-level behavioral abstractions and cannot be directly derived from behavior sequences, we associate each type with a quantitative indicator as its measurable proxy. The detailed computation of each indicator is summarized in Table 3. We refer to a time slot containing at least one flow for an IP-pair as an active slot. Access Intensity is measured by the average flow count within active slots, reflecting the short-term access intensity during active periods. Under the Access Activity perspective, we use ratio-based indicators over the L-slot behavior sequence to capture the temporal coverage and continuity of active behavior. For attribute types under the Temporal Dynamics and Flow Consistency perspectives, we quantify variation using the coefficient of variation (CV) and convert it into a bounded stability score S:

Behavioral Attribute Derivation

Next, we propose Behavioral Attribute Derivation (BAD) to derive human-understandable behavioral attributes from behavior sequences. As illustrated in Fig. 6, BAD first defines behavioral attributes by specifying attribute types and their corresponding levels for describing IP-pair access behaviors. It then employs an indicator-based level assignment strategy, where quantitative indicators serve as measurable proxies to map behavior sequences to the corresponding levels. Behavior Attribute Definition. A behavioral attribute is defined as a combination of an attribute type and its corresponding level. The attribute type captures a specific aspect of IP-pair access behavior, while the level represents the degree of this characteristic using three discrete levels, i.e., Low, Medium, and High. For example, an IP-pair exhibiting high access intensity is described as High Access Intensity. Attribute Types. We design the attribute types from four complementary perspectives motivated by potential differences in access behavior between benign users and HTTP(S) DDoS bots [10,24,36]. These perspectives describe IP-pair behavior in terms of Access Frequency, Access Activity, Temporal Dynamics, and Flow Consistency. Under each perspective, we define attribute types to capture specific access behavior. (1) Access Frequency. Benign users typically request only the resources needed for their current service demands, whereas bots may deliberately generate large numbers of requests to amplify attack impact [10]. Under this perspective, we define Access Intensity to characterize whether a client accesses the server with high intensity. (2) Access Activity. Benign requests are often interspersed with user interactions such as reading, resulting in intermit-

CV =

6

σ , µ

S=

1 , 1 +CV

S ∈ [0, 1],

(1)

Table 3: Attribute types and corresponding indicators. Perspective

Attribute Type

Interpretation

Quantitative Indicator

Access Frequency

Access Intensity

Whether a client accesses the server intensively

Average flows per active slot

Access Activity

Activity Persistence

Ratio of active slots over L-slots

Activity Continuity

Whether access persists throughout the observation window Whether active slots form continuous segments or are interrupted by idle slots

Temporal Dynamics Flow Consistency

Temporal Regularity Access Rate Stability

Whether access follows regular temporal patterns Whether access rate remains stable

S(·) of active-slot intervals S(·) of flow counts in active slot

Packet-Count Consistency Byte-Volume Consistency

Whether packet counts are consistent across flows Whether byte volumes are consistent across flows

S(·) of per-flow pkt counts S(·) of per-flow byte counts

where µ and σ denote the mean and standard deviation of the corresponding observations. A larger S indicates more regular, stable, or consistent behavior. Level Assignment. After computing the indicator values, we map each value to three levels using two thresholds, θlow a high and θa . Specifically, the indicator value ri,a of the a-th attribute type for behavior sequence i is assigned to Low, high low Medium, or High when ri,a ≤ θlow a , θa < ri,a ≤ θa , or high ri,a > θa , respectively. Ratio-based indicators and stability scores S(·) are bounded between 0 and 1, allowing fixed thresholds to be applied on a common scale. In contrast, Access Intensity, measured by flows per active slot, has no natural upper bound. We therefore derive its thresholds from the benign training distribution using percentile-based criteria, providing a fixed reference for mapping access intensity into different semantic levels rather than tracking the instantaneous benign distribution.

Ratio of longest continuous active slots over L-slots

these attribute anchors, we further apply a learnable linear projection to hi , yielding the projected representation zi in the shared latent space. Both zi and va,k are ℓ2 -normalized. Since each behavior sequence is associated with one level for every attribute type, we perform contrastive learning independently across attribute types. For a given type, the matched level is treated as positive, while the remaining levels serve as negatives. Let ci,a ∈ 1, . . . , K denote the matched level of the i-th behavior sequence for the a-th attribute type. The attribute alignment loss is then defined as
A exp z⊤ 1 i va,ci,a /τ Lalign = − ∑ ∑ log ∑K exp z⊤ va,k /τ
, (2) |X |A i∈ k=1 X a=1 i where τ denotes the temperature parameter. Binary Classification Task. Since the ultimate goal of our framework is HTTP(S) DDoS detection, we introduce a classification branch that feeds the behavior representation hi into a linear classifier C(·) to predict the attack probability: ŷi = C(hi ), where ŷi denotes the probability that the i-th behavior sequence is malicious. We use hi for classification because it preserves fine-grained temporal patterns while being jointly optimized by the attribute alignment task. We adopt binary cross-entropy as the classification loss:

3.4 Attribute-Guided Representation Learning After obtaining the behavior sequences and their corresponding behavioral attributes, we develop an attribute-guided representation learning (ARL) framework to learn representations of behavior sequences under the guidance of behavioral attributes. As illustrated in Fig. 7, ARL maps behavior sequences and their corresponding attributes into a shared latent space and encourages their representations to be aligned. To this end, we introduce two complementary learning tasks. Attribute Alignment Task. Let X denote the set of behavior sequences. For each behavior sequence Xi ∈ X , we employ a two-layer 1D-CNN [19] encoder Eb (·) to extract its behavior representation hi = Eb (Xi ). We adopt a 1D-CNN due to its lightweight architecture and effectiveness in modeling sequential patterns. For each attribute type a ∈ {1, . . . , A} and level k ∈ {1, . . . , K}, we introduce a learnable latent vector va,k as the semantic anchor. These latent vectors are randomly initialized and optimized from scratch during training, allowing the model to learn task-specific latent space for different behavioral attributes. To align behavior representations with

Lcls = −

1

∑ |X | i∈ X

[yi log(ŷi ) + (1 − yi ) log(1 − ŷi )] ,

(3)

where yi ∈ {0, 1} denotes the ground-truth of the i-th behavior sequence, indicating benign and malicious, respectively. Overall Loss Function. Finally, we combine the classification and attribute alignment losses as

L = Lcls + λLalign ,

(4)

where λ ∈ [0, 1] controls the contribution of the attribute alignment task. During training, the 1D-CNN encoder Eb (·), the linear projection layer, the attribute latent vectors va,k , and the classifier C(·) are jointly optimized in an end-to-end manner. Through this joint optimization, the model learns to distinguish malicious behaviors while also capturing representative behavioral semantics under attribute guidance. As a result, the learned behavior representations become more transferable. 7

Learnable Attribute Vectors High Mid Low 𝑣11 𝑣12 𝑣13 Intensity Continuity 𝑣21 𝑣22 𝑣23 Regularity 𝑣31 𝑣32 𝑣33

… Attributes of each BS

︙

Projection

1D-CNN Encoder

… BSn BS1 BS2 Behavior Sequences

diverse detection paradigms: (1) NetBeacon [48], a supervised tree-based per-flow detector; (2) FSC [12], a K-Means-based per-flow anomaly detector; (3) Trident [47], an autoencoderbased per-flow anomaly detector; (4) NetVigil [17], a GNNbased autoencoder to detect anomalous hosts; (5) Hypervision [13], a flow interaction graph-based outlier detector; and (6) BS-CNN, a sequence-based method using the same 1DCNN encoder as Tanchun to classify behavior sequences without behavioral attribute supervision. Datasets. We use three widely adopted public datasets: CIC-IDS2017, CIC-IDS2018 [34], and CIC-IoT2023 [28]. These datasets cover diverse HTTP(S) DDoS attacks, including HTTP floods generated by tools such as HOIC, LOIC, and GoldenEye, as well as slow attacks such as Slowloris. We further synthesize two complex attack scenarios that frequently occur in real-world environments and challenge existing detection systems. (1) Encrypted Low-Rate HTTPS Flood (LRHF), where each bot generates only two requests per second to simulate the low-rate flooding observed in a real attack reported by Baidu in 2023 [10]. We combine these attack flows with benign HTTP(S) traffic from the January 2024 MAWI trace [21]. (2) Multi-vector Attack, which combines HOIC, LOIC, GoldenEye, and Slowloris from CIC-IDS2018 in equal proportions, reflecting practical DDoS campaigns that employ multiple attack vectors simultaneously [10]. Based on these datasets, we further construct controlled scenarios to evaluate different forms of traffic drift, as described in the corresponding evaluation subsections. Finally, we validate Tanchun using real HTTP(S) DDoS attack traces and production HTTP(S) traffic collected from an operational web server. Details are presented in § 4.8. Evaluation Procedure and Metrics. Following our detection system, all methods detect HTTP(S) flows using only the flow statistics described in § 2.2. To prevent temporal data leakage, each dataset is chronologically split into training and test sets with an 8:2 ratio, where earlier flows are used for training and later flows for testing. We evaluate flow-level detection performance using accuracy and F1-score.

𝒉

Align with matched Attributes

𝒛

Classifier Benign/Attack

Alignment Loss 𝑳𝒂𝒍𝒊𝒈𝒏

Classification Loss 𝑳𝒄𝒍𝒔

Figure 7: Attribute-Guided Representation Learning.

3.5

End-to-End Workflow

In this subsection, we describe the end-to-end workflow of Tanchun during training and detection, as illustrated in Fig. 4. Training Phase. During training, BSA constructs behavior sequences from training flows using a sliding window of L time slots with a stride of one time slot. BAD then derives the corresponding behavioral attributes. The behavior sequences and their attributes are fed into ARL, which jointly optimizes the model parameters by minimizing the overall objective L . Detection Phase. During detection, BSA constructs behavior sequences from incoming flows using a truncated window of L time slots to ensure complete flow coverage. Each sequence Xi is then fed into the 1D-CNN encoder Eb (·) and classifier C(·) to obtain the attack probability ŷi = C(Eb (Xi )). A sequence is classified as malicious if ŷi > 0.5. Notably, BAD and attribute alignment are only used during training and therefore introduce no additional inference overhead.

4

Evaluation

4.1

Settings

Implementation. Tanchun is implemented in approximately 1,500 lines of Python 3.10.13 code, with the deep learning model built using PyTorch 2.2.1 and CUDA 11.8. For the six bounded indicators in [0, 1], we use thresholds of 0.2 and 0.8, while the unbounded Access Intensity uses the 20th and 80th percentiles of benign training traffic. These thresholds separate the lower and upper tails from the central region, corresponding to Low, Medium, and High levels, respectively. We set the time-slot length ∆t to 1 second and the behaviorsequence length L to 15. The contrastive temperature and attribute alignment weight are set to τ = 0.1 and λ = 0.2, respectively. We train the model with AdamW using a learning rate of 10−4 , a batch size of 64, and 32 epochs. Testbed. We conduct all experiments on a Linux server running Ubuntu 24.04.1 LTS with an AMD Ryzen 9 7950X 32-core CPU, an NVIDIA GeForce RTX 4090D GPU with 24 GB GPU memory, and 128 GB RAM. Baselines. According to our system model §2.2, we compare Tanchun with six flow-based detection methods covering

4.2

Overall Performance

We report the overall comparison between Tanchun and baseline methods across public datasets, synthetic complex attacks, and traffic drift scenarios. We summarize two representative drifts: benign traffic drift (§ 4.3), which evaluates methods on background traffic collected one week after training, and cross-attack event (§ 4.4), which evaluates generalization from known to unseen attacks. Detailed settings and results are provided in the following subsections. As shown in Table 4, Tanchun achieves the best performance across all settings, with an overall F1-score of 0.988. Notably, Tanchun shows strong robustness to traffic drift, outperforming the second-best method by 5.3% and 9.6% under benign and attack drift scenarios, respectively. 8

Table 4: Overall Performance Comparison with Baselines. Methods

NetBeacon FSC Trident NetVigil HyperVision BS-CNN Tanchun

Metrics ACC F1 ACC F1 ACC F1 ACC F1 ACC F1 ACC F1 ACC F1

Public Datasets IDS-17 IDS-18 IOT-23 0.980 0.979 0.995 0.978 0.970 0.995 0.602 0.565 0.676 0.717 0.638 0.568 0.582 0.593 0.682 0.720 0.634 0.782 0.950 0.911 0.945 0.955 0.908 0.935 0.965 0.804 0.696 0.967 0.799 0.771 0.999 0.999 0.995 0.999 0.999 0.995 0.999 0.999 0.992 0.999 0.999 0.992

Complex Attacks LRHF Multi-Vec 0.995 0.942 0.997 0.956 0.401 0.442 0.393 0.403 0.721 0.430 0.813 0.531 0.832 0.913 0.878 0.936 0.603 0.639 0.752 0.780 0.999 0.988 0.999 0.990 0.999 0.989 0.999 0.991

Overall 0.919 0.843 0.498 0.502 0.568 0.630 0.803 0.814 0.668 0.729 0.988 0.965 0.994 0.988

1.0

Tanchun achieves F1-scores above 0.99 on public datasets and remains effective under challenging synthetic attacks. In particular, under the LRHF, where attackers reduce request rates to mimic benign users, Tanchun achieves an F1-score of 0.999, demonstrating its ability to capture discriminative access behaviors beyond traffic volume. Other baselines show different weaknesses: anomaly detection methods (e.g., FSC, Trident, NetVigil, and HyperVision) struggle with attacks resembling benign traffic, especially under LRHF, while NetBeacon is limited by single-flow feature discrimination. Tanchun achieves F1-scores of 0.982 and 0.955 under benign and attack drift scenarios, respectively. Other baselines are more sensitive to traffic drift: anomaly detection methods struggle with benign traffic evolution, while supervised methods fail to generalize to unseen attack features. Although BSCNN captures temporal patterns through behavior sequences, it still underperforms Tanchun by 8.9% and 8.8% under benign and attack drift scenarios, respectively. These results demonstrate the benefit of behavioral attribute supervision.

4.3

Traffic Drift Benign Drift Attack Drift 0.986 0.553 0.932 0.075 0.301 0.498 0.299 0.498 0.412 0.558 0.329 0.601 0.171 0.902 0.271 0.813 0.223 0.746 0.272 0.763 0.972 0.963 0.902 0.871 0.996 0.984 0.982 0.955

F1 score

0.8 0.6 0.4 0.2 0.0

un S-CNN B

h Tanc

FSC Beacon Trident rVision etVigil N e Net Hyp

Figure 8: F1-score under benign traffic drift.

evolve over time, behavioral differences between benign users and attackers remain distinguishable. In contrast, BS-CNN, which only models raw behavior sequences, suffers an 8.2% F1-score drop compared to Tanchun, highlighting the benefit of behavioral attribute supervision. NetBeacon remains effective as its learned attack-flow boundaries largely persist under benign traffic drift. However, shifted benign flows may cross these boundaries, causing false positives and leading to lower performance than Tanchun. Anomaly detection methods (e.g., FSC, Trident, NetVigil, and HyperVision) are more sensitive to benign traffic variations, as shifted benign distributions may be incorrectly identified as anomalies.

Robustness Under Benign Traffic Drift

We use MAWI [21] traces to simulate benign traffic evolution, as they provide real-world benign traffic collected from the same network node on different days. Specifically, we use traces from 2024.1.1 and 2024.1.8, separated by one week, as background traffic. Each trace is combined with representative HTTP(S) DDoS attacks (HOIC, LOIC, GoldenEye, and Slowloris) from CIC datasets [34] to construct datasets. Tanchun is trained on the 2024.1.1 dataset and evaluated on the 2024.1.8 dataset. The results are shown in Fig. 8. Tanchun demonstrates strong robustness against benign traffic drift, achieving an F1-score close to 1.0 with only minor degradation. This robustness stems from its ability to capture stable IP-pair access behaviors: although traffic statistics may

4.4

Robustness Under Attack Pattern Drift

Attack Rate Reduction. We simulate a common evasion strategy where attackers reduce the request rate of individual bots to make attack traffic resemble benign access [10]. We use the LOIC dataset, an HTTP flood trace, for evaluation. We train the model on the original dataset and randomly reduce the number of attack flows generated by each bot in the test set to simulate different request rate reductions. Since per-flow detection methods are independent of such aggregated traffic changes, we exclude them from this evaluation. The F1-score variation under different attack rates is shown in Fig. 9a. 9

Tanchun BS-CNN

50

60

HyperVision NetVigil

65

70

75

Attack Rate Reduction (%)

(a) F1-score under attack-rate reduction.

0.9 0.8 0.7 0.6

Tanchun BS-CNN

0

10

30

(b) BS-CNN

0.999 0.999 0.960 0.918

0.999 0.999 0.960 0.620

IC LO

0.999 0.999 0.841 0.827

0.999 0.999 0.430 0.620

ye nE

0.999 0.999 0.999 0.954

0.999 0.999 0.999 0.862

is

0.999 0.999 0.960 0.998

0.999 0.999 0.960 0.998

HO

e ld Go

HyperVision NetVigil

20

Type of Training Attack

1.0

F1 Score

F1 Score

1.0 0.9 0.8 0.7 0.6 0.5

(a) Tanchun IC

40

Paused Attack Time (%)

50

(b) F1-score under random attack pauses.

r lo

w

o Sl

IC

HO

ye

C

I LO

E en

ld

Go

is or

l ow

Sl

IC

HO

C

I LO

e

Ey

en

ld

Go

lo

ow

Sl

ris

Type of Testing Attack

(c) F1-score under cross-event attack.

Figure 9: Robustness under different attack drift scenarios. Tanchun achieves the best F1-score across different levels of attack-rate reduction, with BS-CNN ranking second. This suggests that, despite the reduced attack rate, the temporal pattern differences between bots and benign users remain distinguishable. Under severe rate reduction (i.e., 75%), Tanchun outperforms BS-CNN by 32.7%. This advantage stems from attribute alignment, which helps Tanchun capture rate-independent behavioral characteristics, such as regular request patterns, and learn more robust representations. In contrast, HyperVision and NetVigil are more sensitive to rate reduction because their detection relies heavily on trafficvolume-related features, such as the aggregated IP-pair flow counts, which are affected by the decrease in attack rate. Intermittent Attacks. Attackers can evade temporal behavior analysis by intermittently pausing their attacks, e.g., through pulse attacks [3]. Such pauses reduce access activity and temporal regularity, making bots resemble benign users and challenging Tanchun’s relevant attributes. To simulate this behavior, we randomly insert one-second pauses into LOIC attack traces while keeping benign flows unchanged, varying the paused fraction from 0% to 50%. All models are trained on the original traces and evaluated under different pause ratios. Fig. 9b shows the F1-score changes of the four methods that consider IP-pair behavior. It can be seen that Tanchun maintains the best F1-score as the attack-pause ratio increases. BS-CNN achieves the second-best performance, but its F1-score is 13.6% lower than Tanchun at a 40% pause ratio. This is because frequent pauses substantially distort the raw behavior sequences learned by BS-CNN, leading to classification errors. In contrast, Tanchun additionally leverages behavioral attributes. Although Activity Persistence, Activity Continuity, and Temporal Regularity are affected by pauses, more stable semantics such as Flow Consistency still help distinguish attackers from benign users. HyperVision and NetVigil perform substantially worse than Tanchun, mainly because more frequent pauses reduce observable attack rate, making malicious traffic more similar to benign behavior and resulting in more false negatives. Cross-Attack Events. Attackers may employ different tools or strategies across attack events, leading to variations in attack behaviors over time. To evaluate this scenario, we

use four HTTP(S) DDoS events from IDS18 [34], including LOIC, HOIC, GoldenEye, and Slowloris, generated by different attack tools with benign background traffic collected from the same network environment. Each method is trained on one attack event and tested on the others. The cross-attack event performance is summarized in Table 4. In addition, Fig. 9c presents the cross-event transfer matrices of Tanchun and the best-performing baseline, while the complete matrices of other methods are provided in Appendix D. Tanchun consistently achieves the best performance across all training-testing combinations, demonstrating strong robustness to unseen attack vectors by capturing stable malicious behaviors shared across attacks. In contrast, BS-CNN yields an average F1-score 8.8% lower and fails in three combinations, highlighting the value of behavioral attribute supervision for learning robust semantics. NetBeacon nearly loses its detection capability when attack-flow features differ substantially from those seen during training. Trident, FSC, and HyperVision struggle with Slowloris because its flow characteristics closely resemble benign traffic. NetVigil performs well in most cases through IP-pair aggregation and graph modeling, but remains less effective on Slowloris, indicating that its graph-based modeling is less effective at capturing the temporal dynamics of Slowloris attacks.

4.5

Ablation Study

In this subsection, we evaluate the effectiveness of Tanchun’s core components through ablation studies. We consider benign traffic drift and cross-attack event scenarios, where the latter serves as a representative case of attack drift. Study on Behavior Sequence Abstraction. To validate the effectiveness of behavior sequences for temporal analysis, we construct a variant, w/o BS, that removes the time-slotbased sequence construction. Specifically, we aggregate the features of each IP pair over the entire observation window of length L and replace the 1D-CNN with an MLP of the same depth, since sequential modeling is no longer required. The results are shown in Table 5. Removing behavior sequence substantially degrades performance under attack drift, with the F1-score dropping from 0.955 to 0.292. This result shows that, 10

Table 5: Ablation study on the key modules. Study Variant BSA (§ 3.2) w/o BS ARL (§ 3.4) w/o Lalign Attribute Utilization Full

Attribute-only Indicator-only Indicator Concat. Attr. Pred. Tanchun

narios. Under the benign traffic drift and attack drift scenarios, it improves the performance by 6.8% and 6.5%, respectively, compared with the worst cases. This is because when L is set too small, the available temporal information is insufficient to distinguish malicious behaviors. In contrast, when L is set too large, excessive redundant information is introduced, which may hinder the model from capturing essential patterns. Therefore, we set L = 15 in our implementation. Analysis of the Attribute Alignment Loss Weight. We vary the weight λ of Lalign from 0.1 to 0.8, with the resulting F1-scores shown in Fig. 10b. Under benign traffic drift, the F1score improves as λ increases to 0.2 and then remains nearly stable. Under attack drift, the F1-score also reaches its highest level at λ = 0.2, remains on a plateau, and drops sharply at λ = 0.8. The plateau improves F1-score by 7.6% and 6.6% over λ = 0.1 and λ = 0.8, respectively. This indicates that a moderate λ promotes more generalizable behavioral semantics, while an overly large weight weakens fine-grained temporal modeling. We therefore set λ = 0.2 as the default. Analysis of Level Assignment Threshold. We vary the high threshold pair (θlow a , θa ) from 10–90 to 30–70 while keeping other settings fixed. For the unbounded attribute Access Intensity, these values denote percentiles, while for bounded indicators, 10–90 corresponds to normalized thresholds of 0.1 and 0.9, respectively. As shown in Fig. 10c, under benign traffic drift, the F1-score increases from 0.949 at 10–90 to 0.992 at 25–75 and then remains nearly stable. Under attack drift, performance peaks at 20–80 with an F1-score of 0.955, but drops to 0.919 at 30–70. A larger gap between θlow a and high θa assigns more samples to the medium level, weakening supervision from the low and high levels, whereas a smaller gap may separate similar borderline behaviors into different levels and introduce assignment ambiguity. We therefore use 20–80 as the default setting, which provides the best overall balance across the two drift scenarios.

Benign Drift Attack Drift 0.980 0.292 0.902 0.871 0.819 0.764 0.909 0.982 0.982

0.721 0.896 0.851 0.871 0.955

compared with coarse-grained IP-pair aggregation, behavior sequences better preserve temporal access patterns that are important for identifying diverse attack behaviors. Study on Attribute-guided Representation Learning. We evaluate whether the proposed attribute alignment task (Lalign ) improves the generalizability of Tanchun. We set the weight λ of Lalign to 0 while keeping the remaining model unchanged, denoted as w/o Lalign . As shown in Table 5, the F1-score decreases from 0.982 to 0.902 under benign traffic drift and from 0.955 to 0.871 under attack drift. These results indicate that the behavioral abstractions provided by the attributes can serve as effective supervision signals, guiding the model toward more generalizable representations. Alternative Utilization of Behavioral Attributes. We compare four alternative ways of utilizing behavioral attributes. (1) Attribute-only: We directly detect attacks using the multi-hot attribute vector generated with the same criteria as in training. (2) Indicator-only: We use the seven quantitative indicators corresponding to the behavioral attributes as detection features. (3) Indicator Concat.: We concatenate the seven indicators with the behavior sequence representation for detection. (4) Attr. Pred.: We replace attribute alignment with a conventional auxiliary task that predicts behavioral attributes from the behavior sequence representation. As shown in Table 5, none of these variants consistently matches Tanchun across both drift scenarios. The Attribute-only and Indicator-only variants fail to retain fine-grained temporal patterns, while concatenation and attribute prediction provide only limited semantic supervision. In contrast, Tanchun’s attribute alignment directly constrains the representation space, enabling more generalizable behavioral semantics.

4.6

4.7

Representation Analysis

We analyze Tanchun’s learned behavior sequence representations h under 12 cross-attack event training-testing combinations. For each combination, we compute cosine distances among benign–benign, attack–attack, and benign–attack representation pairs. As shown in Fig. 11a, benign and attack representations have small intra-class distances but much larger inter-class distances, indicating that Tanchun learns compact and well-separated representations. Such representation structure supports robust detection under traffic drift. We further quantify the clustering quality of the learned representations using the binary silhouette score [33], which jointly measures intra-class compactness and inter-class separation. Specifically, for each of the 12 cross-event training-testing combinations, we compute the silhouette score between benign and attack representations and compare Tanchun with BS-CNN. As shown in Fig. 11b, Tanchun

Parameter Analysis

In this subsection, we use the same scenarios as in § 4.5 to analyze the impact of several key parameters. Analysis on Behavior Sequence Length. 2 We vary the length L of the behavior sequence from 5 to 25, and the changes in Tanchun’s F1-score are shown in Fig. 10a. As observed, setting L=15 achieves the best F1-score in both sce2We keep ∆t fixed, as ∆t and L jointly determine the temporal observation

horizon. We therefore analyze L to avoid redundant parameter combinations.

11

1.0

0.9 Benign Traffic Drift Attack Drift

0.8

5

10

15

20

25

Behavior Sequence Length L

(a) Analysis of behavior sequence length.

1.0

F1-score

F1-score

F1-score

1.0

0.9 Benign Traffic Drift Attack Drift

0.8

0.1 0.2

0.4

0.6

Alignment Loss Weight λ

0.9 Benign Traffic Drift Attack Drift

0.8 10–90

0.8

15–85

20–80

25–75

30–70

Lower–Upper Threshold Pair

(b) Analysis of alignment loss weight.

(c) Analysis of level assignment threshold.

0.6 Benign–Benign Attack–Attack Benign–Attack

0.4 0.2 0.0 0.00

0.25

0.50

0.75

Cosine distance

1.00

1.0 1.0

0.9

0.946

0.8 0.7

0.844

0.8

0.750

0.7

0.666

0.6

0.6

Tanchun

BS-CNN

0.561

0.5 0.4

(a) Distance Distribution

0.928

0.896

0.9

Train Dataset

CDF

0.8

F1 score

1.0

Binary silhouette score

Figure 10: Sensitivity analysis of three key parameters.

(b) Binary Silhouette Score

hun S-CNNNetvigil rvision Trident B e Hyp

Tanc

0.95

0.99

0.99

0.97

HTTPS 2 0.88

0.94

0.97

0.99

1.00

HTTP 1 0.56

0.78

0.93

0.97

0.93

HTTP 2

0.88

0.87

0.95

0.97

1.00

HTTP 3 0.97

0.95

0.97

0.99

1.00

S1 S2 P1 P2 P3 HTTP HTTP HTT HTT HTT FSC eacon NetB

(a) Comparison Evaluation

Figure 11: Analysis of the behavior sequence representation.

HTTPS 1 0.90

Test Dataset

(b) Cross-Attack Event

Figure 12: Detection results on real-world traffic trace. improves the average silhouette score from 0.894 to 0.924 and the worst-case score from 0.651 to 0.771, demonstrating that behavioral attribute supervision yields more compact and separable representations under traffic drift.

4.8

4.9

Efficiency Evaluation

When the flows to be detected enter the system, Tanchun’s detection consists of two main stages: behavior sequence generation on the CPU and neural network inference on the GPU. We separately measure the latency of these two stages and evaluate the overall throughput. Since neural inference can benefit from batch processing, we vary the batch size from 16 to 256, with the results shown in Fig. 13. Latency. As shown in Fig. 13a, behavior sequence generation introduces a fixed overhead of approximately 4.43µs per flow. Neural network inference benefits from batch processing, and its amortized latency decreases significantly as the batch size increases. Specifically, increasing the batch size from 16 to 256 reduces the neural inference latency from 2.8µs to only 0.18µs per flow. At a batch size of 256, Tanchun achieves an overall detection latency of 4.61µs per flow. Throughput. As shown in Fig. 13b, Tanchun’s detection throughput increases with the batch size and reaches 218K flows/s at a batch size of 256. However, further increasing the batch size provides limited improvement, as behavior sequence generation becomes the bottleneck. Given that Internet services may generate around 100K flows per second [22], these results show that Tanchun can process such large-scale flows in real time.

Evaluation with Real-World Traffic

We evaluate Tanchun in a deployment-oriented testbed using real-world HTTP(S) production traffic and DDoS attack traces. The benign traffic is collected from an operational campus web server cluster hosting multiple websites and contains 317,010 HTTP(S) flows. The attack traffic comprises five real HTTP(S) DDoS traces, including two HTTPS floods and three HTTP floods, collected from a top-tier DDoS scrubber [18] and verified by security operators. In the testbed, we continuously replay production traffic and inject each attack trace separately, allowing the system to process mixed benign and attack flows in a deployment-relevant setting. We conduct two experiments: (i) known-attack detection, where Tanchun is compared with existing baselines; and (ii) unseen-attack detection, where Tanchun is trained on one attack type and evaluated on the remaining unseen attack types. As shown in Figure 12a, Tanchun achieves the highest average F1-score across all five attacks, outperforming the baselines by 22.3% on average. This result suggests that Tanchun remains effective on real-world attack traces. As shown in Figure 12b, Tanchun also maintains F1-scores close to or above 0.90 for most train-test pairs, indicating promising generalization to unseen attacks. Overall, these results suggest that Tanchun can maintain reliable detection performance on real-world HTTP(S) DDoS.

5

Discussion

Training Data for Tanchun. The training data is generally available in practical deployments. Benign flows can be di12

BS generation Neural inference

6 4 2 0

16

32

64 128 Batch size

256

(a) Latency of Each Stage.

Throughput (Kflows/s)

Latency (μs/flow)

8

ioral attributes and evaluate their effectiveness across broader attack scenarios.

225 200 175

6

150 125

16

32

64 128 Batch size

256

Related Work

HTTP(S) DDoS Defense. Liao et al. [24] detect malicious users by modeling inter-request patterns. Xie et al. [40,41] analyze website access behaviors and request relationships using hidden semi-Markov models. Singh et al. [36] further characterize user behaviors based on request frequency and resource repetition. However, these approaches rely on applicationlayer information, which typically requires HTTPS decryption and introduces additional decryption overhead and may raise privacy concerns. Volumetric DDoS Defense. Some methods detect DDoS using flow data collected from IXP or ISPs. IXPScrubber [39] learns flow features from blackholing traffic, and Xatu [44] leverages auxiliary signals to enhance detection. Some methods defend against DDoS on programmable switches. Poseidon [46] and Jaqen [25] mitigate volumetric DDoS attacks by deploying rules. Ripple [42] and Mew [49] mitigate link-flooding attacks [20, 38] by analyzing multi-switch traffic. ACC-Turbo [3] defends against pulsewave DDoS by aggregate-based congestion control. However, HTTP(S) DDoS do not usually consume excessive bandwidth, making it difficult to trigger the volumetric DDoS defenses. Encrypted Traffic Detection. Kitsune [27] and nPrintML [16] perform packet-level detection using AutoEncoder and AutoML, respectively. NetBeacon [48] and FlowLens [5] use tree models to classify traffic based on flow statistics, Trident [47] learns flow representations under class-incremental settings, and Whisper [12] captures frequency-domain characteristics of flows. However, HTTP(S) DDoS attacks often consist of seemingly legitimate requests, limiting the discriminative power of packet- and flow-level features. HyperVision [13] and NetVigil [17] further model inter-flow relationships and an IP-pair–level graph, respectively. Nevertheless, neither explicitly captures attackers’ temporal access patterns, potentially overlooking malicious temporal behaviors.

(b) Detection Throughput.

Figure 13: Tanchun efficiency evaluation.

rectly collected from the target network through existing flow telemetry systems [7, 26]. For attack flows, existing HTTP(S) defense mechanisms, such as decryption-based detectors [10] and JS challenge systems [32], can provide high-confidence malicious samples. By leveraging these existing detection results during training, Tanchun can learn attack behaviors while reducing the reliance on costly decryption and minimizing disruptions to benign users caused by JS challenges. Consideration on Behavioral Attributes. Tanchun defines behavioral attributes based on domain knowledge of common attack and benign behaviors. These attributes serve as stable semantic anchors to learn robust behavioral semantics under traffic drift. As supervision signals rather than detection rules, they allow Tanchun to tolerate attribute-level annotation noise caused by threshold-based assignment uncertainty (Appendix C). Attribute quality and coverage can be further improved through operational feedback and automated attribute discovery techniques [30]. Collective Behavior Analysis. In HTTP(S) DDoS attacks, bots from the same campaign may exhibit similar behavioral patterns, providing additional signals for identifying coordinated attacks. Tanchun learns a discriminative representation space where malicious IP-pairs with similar access behaviors tend to cluster together (§ 4.7). Future work can leverage cluster-level characteristics, such as cluster density and behavioral consistency, to further enhance detection. Co-Optimization with Flow Telemetry. Further improvements in end-to-end detection efficiency can be achieved through flow telemetry optimization. Reducing the flow export interval to the second level [29] can better align telemetry granularity with Tanchun’s behavior sequence construction. Moreover, adaptive configuration of flow active and inactive timeouts [29] can balance detection timeliness and flow completeness. Shorter inactive timeouts can reduce delays caused by long-lived connections, such as Slowloris, while shorter active timeouts can enable earlier detection, since early-stage flows may already provide sufficient information for IP-pair analysis. We will explore this trade-off in future work. Detect Other Attacks. The design principle of Tanchun may apply to other attacks that exhibit malicious access behavioral patterns, such as DNS query flooding [4] and brute-force attacks [15]. Future work will explore attack-specific behav-

7

Conclusion

This paper presents Tanchun, a novel flow-based HTTP(S) DDoS detection framework that leverages humanunderstandable behavioral attributes as semantic supervision. Tanchun first models the temporal access behaviors of IP-pairs from flow statistics and derives behavioral attributes from multiple perspectives to comprehensively characterize access behavior. Through attribute-guided representation learning, Tanchun aligns traffic representations with behavioral semantics, thereby improving the robustness of HTTP(S) DDoS detection under traffic drift.

13

References

[12] Chuanpu Fu, Qi Li, Meng Shen, and Ke Xu. Realtime robust malicious traffic detection via frequency domain analysis. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 3431–3446, 2021.

[1] Akamai. How akamai protects customers from http/2 rapid reset ddos attacks, 2025. https://www.akamai .com/blog/security/akamai-protects-custome rs-http2-rapid-reset-ddos-attacks.

[13] Chuanpu Fu, Qi Li, and Ke Xu. Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis.

[2] Ziad Al-Halah and Rainer Stiefelhagen. How to transfer? zero-shot object recognition via hierarchical transfer of semantic attributes. In 2015 IEEE winter conference on applications of computer vision, pages 837–843. IEEE, 2015.

[14] Rick Hofstede, Pavel Čeleda, Brian Trammell, Idilio Drago, Ramin Sadre, Anna Sperotto, and Aiko Pras. Flow monitoring explained: From packet capture to data analysis with netflow and ipfix. IEEE Communications Surveys & Tutorials, 16(4):2037–2064, 2014.

[3] Albert Gran Alcoz, Martin Strohmeier, Vincent Lenders, and Laurent Vanbever. Aggregate-based congestion control for pulse-wave ddos defense. In Proceedings of the ACM SIGCOMM 2022 Conference, pages 693–706, 2022.

[15] Rick Hofstede, Mattijs Jonker, Anna Sperotto, and Aiko Pras. Flow-based web application brute-force attack and compromise detection. Journal of network and systems management, 25(4):735–758, 2017.

[4] Roberto Alonso, Raúl Monroy, and Luis A Trejo. Mining ip to domain name interactions to detect dns flood attacks on recursive dns servers. Sensors, 16(8):1311, 2016.

[16] Jordan Holland, Paul Schmitt, Nick Feamster, and Prateek Mittal. New directions in automated traffic analysis. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 3366– 3383, 2021.

[5] Diogo Barradas, Nuno Santos, Luís Rodrigues, Salvatore Signorello, Fernando MV Ramos, and André Madeira. Flowlens: Enabling efficient flow classification for ml-based network security applications. In NDSS, 2021.

[17] Kevin Hsieh, Mike Wong, Santiago Segarra, Sathiya Kumaran Mani, Trevor Eberl, Anatoliy Panasyuk, Ravi Netravali, Ranveer Chandra, and Srikanth Kandula. {NetVigil}: Robust and {Low-Cost} anomaly detection for {East-West} data center security. In 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI 24), pages 1771–1789, 2024.

[6] Samuel Black and Yoohwan Kim. An overview on detection and prevention of application layer ddos attacks. In 2022 IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC), pages 0791–0800. IEEE, 2022. [7] Benoit Claise. Cisco systems netflow services export version 9. Technical report, 2004.

[18] Huawei. Huawei hisecengine antiddos12000 series ddos defense system, 2026. https://e.huawei.com/au/ products/security/12000?from=search.

[8] Alibaba Cloud. Configure the http flood mitigation feature, 2025. https://www.alibabacloud.com/h elp/en/anti-ddos/anti-ddos-pro-and-premium /user-guide/configure-accurate-access-con trol-rules.

[19] Ayokunle Olalekan Ige and Malusi Sibiya. State-of-theart in 1d convolutional neural networks: A survey. IEEE Access, 2024. [20] Min Suk Kang, Soo Bum Lee, and Virgil D Gligor. The crossfire attack. In 2013 IEEE symposium on security and privacy, pages 127–141. IEEE, 2013.

[9] cloudflare. Ddos threat report for 2025 q1, 2025. https: //radar.cloudflare.com/reports/ddos-2025-q 1.

[21] CHO Kenjiro. Traffic data repository at the wide project. In Proc. USENIX 2000 Annual Technical Conference: FREENIX Track, San Diego, CA, 2000.

[10] China Telecom Cybersecurity Technology Co. et al. Global ddos attack status and trend analysis in 2023, 2024. https://e.huawei.com/eu/material/netwo rking/security/0c561b8fd2d342999cd402bcecf 6d452.

[22] Yuanpeng Li, Xian Niu, Yikai Zhao, Tong Yang, Yannan Hu, Yuchao Zhang, Xiangwei Deng, Qiuheng Yin, Ziyun Zhang, Ruwen Zhang, et al. Titanlog: Hierarchical and elastic logging for high-speed network data stream.

[11] Yebo Feng, Jun Li, and Thanh Nguyen. Applicationlayer ddos defense with reinforcement learning. In 2020 IEEE/ACM 28th International Symposium on Quality of Service (IWQoS), pages 1–10. IEEE, 2020.

[23] Yuliang Li, Rui Miao, Changhoon Kim, and Minlan Yu. {FlowRadar}: A better {NetFlow} for data centers. In 14

[33] Peter J Rousseeuw. Silhouettes: a graphical aid to the interpretation and validation of cluster analysis. Journal of computational and applied mathematics, 20:53–65, 1987.

13th USENIX symposium on networked systems design and implementation (NSDI 16), pages 311–324, 2016. [24] Qin Liao, Hong Li, Songlin Kang, and Chuchu Liu. Application layer ddos attack detection using cluster with label based on sparse vector decomposition and rhythm matching. Security and Communication Networks, 8(17):3111–3120, 2015.

[34] Iman Sharafaldin, Arash Habibi Lashkari, Ali A Ghorbani, et al. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp, 1(2018):108–116, 2018.

[25] Zaoxing Liu, Hun Namkung, Georgios Nikolaidis, Jeongkeun Lee, Changhoon Kim, Xin Jin, Vladimir Braverman, Minlan Yu, and Vyas Sekar. Jaqen: A {HighPerformance}{Switch-Native} approach for detecting and mitigating volumetric {DDoS} attacks with programmable switches. In 30th USENIX Security Symposium (USENIX Security 21), pages 3829–3846, 2021.

[35] Meng Shen, Ke Ye, Xingtong Liu, Liehuang Zhu, Jiawen Kang, Shui Yu, Qi Li, and Ke Xu. Machine learningpowered encrypted network traffic analysis: A comprehensive survey. IEEE Communications Surveys & Tutorials, 25(1):791–824, 2022. [36] Karanpreet Singh, Paramvir Singh, and Krishan Kumar. User behavior analytics-based classification of application layer http-get flood attacks. Journal of Network and Computer Applications, 112:97–114, 2018.

[26] Sathiya Kumaran Mani, Kevin Hsieh, Santiago Segarra, Ranveer Chandra, Yajie Zhou, and Srikanth Kandula. Securing public cloud networks with efficient role-based {Micro-Segmentation}. In 22nd USENIX Symposium on Networked Systems Design and Implementation (NSDI 25), pages 1033–1048, 2025.

[37] John Sonchack, Adam J Aviv, Eric Keller, and Jonathan M Smith. Turboflow: Information rich flow record generation on commodity switches. In Proceedings of the Thirteenth EuroSys Conference, pages 1–16, 2018.

[27] Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. Kitsune: An ensemble of autoencoders for online network intrusion detection. In Network and Distributed Systems Security (NDSS) Symposium, 2018.

[38] Ahren Studer and Adrian Perrig. The coremelt attack. In European Symposium on Research in Computer Security, pages 37–52. Springer, 2009.

[28] Euclides Carlos Pinto Neto, Sajjad Dadkhah, Raphael Ferreira, Alireza Zohourian, Rongxing Lu, and Ali A Ghorbani. Ciciot2023: A real-time dataset and benchmark for large-scale attacks in iot environment. Sensors, 23(13):5941, 2023.

[39] Matthias Wichtlhuber, Eric Strehle, Daniel Kopp, Lars Prepens, Stefan Stegmueller, Alina Rubina, Christoph Dietzel, and Oliver Hohlfeld. Ixp scrubber: learning from blackholing traffic for ml-driven ddos detection at scale. In Proceedings of the ACM SIGCOMM 2022 Conference, pages 707–722, 2022.

[29] Netscout. Understanding netflow latency and effectiveness in detecting and mitigating ddos attacks, 2026. https://www.netscout.com/resources/fact-s heets/understanding-netflow-latency-and-e ffectiveness-in-detecting-and-mitigating-d dos-attacks.

[40] Yi Xie and Shun-Zheng Yu. A large-scale hidden semimarkov model for anomaly detection on user browsing behaviors. IEEE/ACM transactions on networking, 17(1):54–65, 2008.

[30] Sagar Patel, Dongsu Han, Nina Narodytska, and Sangeetha Abdu Jyothi. Agua: A concept-based explainer for learning-enabled systems. In Proceedings of the ACM SIGCOMM 2025 Conference, pages 329–346, 2025.

[41] Yi Xie and Shun-Zheng Yu. Monitoring the applicationlayer ddos attacks for popular websites. IEEE/ACM Transactions on networking, 17(1):15–25, 2008. [42] Jiarong Xing, Wenqing Wu, and Ang Chen. Ripple: A programmable, decentralized {Link-Flooding} defense against adaptive adversaries. In 30th USENIX Security Symposium (USENIX Security 21), pages 3865–3881, 2021.

[31] Amit Praseed and P Santhi Thilagam. Ddos attacks at the application layer: Challenges and research perspectives for safeguarding web applications. IEEE Communications Surveys & Tutorials, 21(1):661–685, 2018.

[43] Wenjia Xu, Yongqin Xian, Jiuniu Wang, Bernt Schiele, and Zeynep Akata. Attribute prototype network for zero-shot learning. Advances in Neural Information Processing Systems, 33:21969–21980, 2020.

[32] radware. Javascript challenge, 2026. https://www.ra dware.com/cyberpedia/application-security/ javascript-challenge/. 15

B

[44] Zhiying Xu, Sivaramakrishnan Ramanathan, Alexander Rush, Jelena Mirkovic, and Minlan Yu. Xatu: Boosting existing ddos detection systems using auxiliary signals. In Proceedings of the 18th International Conference on emerging Networking EXperiments and Technologies, pages 1–17, 2022.

Attackers can request different legitimate resources to launch HTTP(S) DDoS, causing their flow size to change and challenging the generalization capability of detection models. To simulate this scenario, we use the LOIC trace and proportionally scale the total packet and byte counts of each attack flow to simulate variations in requested resources. Specifically, we train models on the original scale (1x) and evaluate them on the modified datasets with different scaling factors. The results are shown in Fig. 14.

[45] Limin Yang, Wenbo Guo, Qingying Hao, Arridhana Ciptadi, Ali Ahmadzadeh, Xinyu Xing, and Gang Wang. {CADE}: Detecting and explaining concept drift samples for security applications. In 30th USENIX Security Symposium (USENIX Security 21), pages 2327–2344, 2021.

Tanchun demonstrates strong robustness against flow size drift, maintaining nearly unchanged F1-scores and achieving the best performance. BS-CNN shows similar robustness, as both methods capture IP-pair-level temporal access patterns that remain consistent despite per-flow statistics drift. In contrast, NetBeacon, which relies on single-flow features, fails to detect attacks under large-scale changes (e.g., 0.5× and 1.5×), as the drifted features deviate from its learned decision boundaries. The anomaly detection methods remain relatively stable since benign traffic distributions are unchanged, but still achieve lower F1-scores than Tanchun.

[46] Menghao Zhang, Guanyu Li, Shicheng Wang, Chang Liu, Ang Chen, Hongxin Hu, Guofei Gu, Qianqian Li, Mingwei Xu, and Jianping Wu. Poseidon: Mitigating volumetric ddos attacks with programmable switches. In the 27th Network and Distributed System Security Symposium (NDSS 2020), 2020. [47] Ziming Zhao, Zhaoxuan Li, Zhuoxue Song, Wenhao Li, and Fan Zhang. Trident: A universal framework for finegrained and class-incremental unknown traffic detection. In Proceedings of the ACM on Web Conference 2024, pages 1608–1619, 2024.

F1 Score

1.0

[48] Guangmeng Zhou, Zhuotao Liu, Chuanpu Fu, Qi Li, and Ke Xu. An efficient design of intelligent network data plane. In 32nd USENIX Security Symposium (USENIX Security 23), pages 6203–6220, 2023.

0.8 0.6 0.4 0.2 0.0

[49] Huancheng Zhou, Sungmin Hong, Yangyang Liu, Xiapu Luo, Weichao Li, and Guofei Gu. Mew: Enabling large-scale and dynamic link-flooding defenses on programmable switches. In 2023 IEEE Symposium on Security and Privacy (SP), pages 3178–3192. IEEE, 2023.

Tanchun BS-CNN

0.5

FSC NetBeacon

Trident HyperVision

NetVigil

0.75 1 1.25 Flow-size scaling factor

1.5

Figure 14: F1-score with varying attack flow size.

C A

Robustness Under Flow-Size Drift

Robustness to Attribute Noise

Ethical Considerations Since Tanchun relies on behavioral attributes generated from indicators and predefined thresholds, these attributes may contain noise due to imperfect abstraction of real-world behaviors. To evaluate robustness, we randomly perturb the behavioral attributes in the training set by changing the levels of a ratio R of attributes to other levels. We vary R from 0 to 0.3, and the results are shown in Fig. 15. As the attribute noise increases, Tanchun maintains a nearly unchanged F1-score under benign drift, and the F1-score under attack drift only slightly decreases while remaining above 0.9. These results demonstrate that Tanchun is robust to attribute noise. This is because the original behavior sequences are preserved for detection, and the remaining correct attributes can still provide effective supervision for optimizing the attribute alignment.

This work does not raise any ethical concerns. User Privacy. The data used in this paper do not involve user privacy concerns. First, the three datasets used in this study were all legally obtained from their official websites. Second, all real-world traffic traces used in our study were collected with authorization, and sensitive information such as IP addresses was anonymized. Moreover, our detection relies solely on flow data and does not require decrypting user payloads, thereby avoiding the exposure of private content. Attack Isolation. Although this work studies network traffic detection, it does not cause any harm to real-world networks. All attack generation and traffic replay experiments in this paper were conducted within isolated testbeds. 16

F1-score

1.0 0.9 0.8

Benign Traffic Drift Attack Drift

0

10 20 30 Noisy Attribute Ratio (%)

Figure 15: F1-score Variation under Attribute Noise.

D

Performance Under Cross Attack Events

We train each model on the training set of each of the four attack traces in CIC-IDS2018 and evaluate it on the test set of all four attacks. The results are shown in Fig. 16. Notably, HyperVision is an outlier-detection method and does not involve explicit training. However, it requires several predefined hyperparameters, which we found to be relatively sensitive. Therefore, for each training set, we search for the best hyperparameter configuration, fix the selected configuration, and use it to evaluate the other attack traces.

17

0.918

LOIC

0.999

0.999

0.841

0.827

enEy

e

0.999

0.999

0.999

0.954

loris Slow

0.999

0.999

0.960

0.998

HOIC

s

LOIC oldenEye Slowlori G

Type of Testing Attack

Type of Training Attack

(a) Tanchun 0.946

0.803

0.407

0.093

LOIC

0.000

0.903

0.357

0.217

e

0.936

0.778

0.562

0.135

loris Slow

0.938

HOIC

0.782

0.526

0.139

s

LOIC oldenEye Slowlori G

Type of Testing Attack

(e) FSC

0.999

0.960

0.620

LOIC

0.999

0.999

0.430

0.620

enEy Gold

e

0.999

0.999

0.999

0.862

loris

0.999

0.999

0.960

0.998

Slow

HOIC

HOIC

1.000

0.000

0.042

0.000

LOIC

0.000

0.999

0.000

0.000

e enEy

0.761

0.000

0.882

0.000

loris

0.088

0.000

0.011

0.999

Gold

Slow

s LOIC oldenEye Slowlori G

HOIC

Type of Testing Attack

HOIC

0.948

0.734

0.590

0.160

LOIC

0.950

0.816

0.614

0.160

e enEy

0.944

0.757

0.606

0.163

loris

0.944

0.804

0.396

0.164

Gold

Slow

s LOIC oldenEye Slowlori G

HOIC

Type of Testing Attack

(b) BS-CNN

HOIC

enEy

Gold

0.999

Type of Training Attack

Gold

HOIC

Type of Training Attack

0.960

(c) NetBeacon HOIC

0.992

0.968

0.913

0.576

LOIC

0.941

0.842

0.589

0.147

e enEy

0.987

0.960

0.903

0.511

Gold

Slo

s wlori

0.999

HOIC

0.998

0.991

0.894

s LOIC oldenEye Slowlori G

Type of Testing Attack

(f) NetVigil

Figure 16: F1-score of different methods for unseen-attack detection.

18

LOIC oldenEye Slowlori G

s

Type of Testing Attack

(d) Trident Type of Training Attack

0.999

Type of Training Attack

0.999

Type of Training Attack

Type of Training Attack

HOIC

HOIC

0.999

0.778

0.562

0.135

LOIC

0.991

0.779

0.093

0.652

e enEy

0.936

0.683

0.563

0.135

s wlori

0.991

0.000

0.000

0.711

Gold

Slo

HOIC

LOIC oldenEye Slowlori G

s

Type of Testing Attack

(g) Hypervision

Related documents

• Tanchun: Robust Flow-Based HTTP(S) DDoS Detection via Behavioral Attribute Guidance#1343917
• Structure and identification of management information for TCP/IP-based internets#131741
• Internet Denial-of-Service Considerations#500760
• CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks#410945
• DoS and DDoS attacks in Software Defined Networks: A survey of existing solutions and research challenges#470978