Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic

arXiv:2604.16575v1 Announce Type: new Abstract: Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks, yet most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data. We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics: lag-1 autocorrelation of an aggregated flow signal and PCA cumulative explained variance. When the probes are inconclusive, the framework reserves a hybrid option as a future fallback rather than an empirically validated branch. Experiments on two statistically distinct datasets with Isolation Forest, One-Class SVM, and KMeans show that structural features consistently match or outperform temporal ones, with the performance gap widening as temporal dependence weakens.

Anomaly Detection in IEC-61850 GOOSE Networks: Evaluating Unsupervised and Temporal Learning for Real-Time Intrusion Detection
ExAI5G: A Logic-Based Explainable AI Framework for Intrusion Detection in 5G Networks
Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining
CLAD: Efficient Log Anomaly Detection Directly on Compressed Representations
Batch Distillation Data for Developing Machine Learning Anomaly Detection Methods

Source: arXiv cs.LG | 2026-04-21

Related