{"id":"https://openalex.org/W4412537163","doi":"https://doi.org/10.1109/netsoft64993.2025.11080537","title":"Protocol-Aware and Adaptive DDoS Defense Framework","display_name":"Protocol-Aware and Adaptive DDoS Defense Framework","publication_year":2025,"publication_date":"2025-06-23","ids":{"openalex":"https://openalex.org/W4412537163","doi":"https://doi.org/10.1109/netsoft64993.2025.11080537"},"language":"en","primary_location":{"id":"doi:10.1109/netsoft64993.2025.11080537","is_oa":false,"landing_page_url":"https://doi.org/10.1109/netsoft64993.2025.11080537","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 11th International Conference on Network Softwarization (NetSoft)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100385015","display_name":"Jihye Kim","orcid":"https://orcid.org/0000-0003-2953-7883"},"institutions":[{"id":"https://openalex.org/I40527276","display_name":"Universit\u00e4t der Bundeswehr M\u00fcnchen","ror":"https://ror.org/05kkv3f82","country_code":"DE","type":"education","lineage":["https://openalex.org/I1315109972","https://openalex.org/I40527276","https://openalex.org/I4387152969"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Jihye Kim","raw_affiliation_strings":["Research Institute CODE, Universität Bundeswehr München,Neubiberg,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Institute CODE, Universität Bundeswehr München,Neubiberg,Germany","institution_ids":["https://openalex.org/I40527276"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078551681","display_name":"Gabi Dreo Rodosek","orcid":"https://orcid.org/0000-0002-8702-8553"},"institutions":[{"id":"https://openalex.org/I40527276","display_name":"Universit\u00e4t der Bundeswehr M\u00fcnchen","ror":"https://ror.org/05kkv3f82","country_code":"DE","type":"education","lineage":["https://openalex.org/I1315109972","https://openalex.org/I40527276","https://openalex.org/I4387152969"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Gabi Dreo Rodosek","raw_affiliation_strings":["Research Institute CODE, Universität Bundeswehr München,Neubiberg,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Institute CODE, Universität Bundeswehr München,Neubiberg,Germany","institution_ids":["https://openalex.org/I40527276"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I40527276"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"257","last_page":"260"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10772","display_name":"Distributed systems and fault tolerance","score":0.4650999903678894,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10772","display_name":"Distributed systems and fault tolerance","score":0.4650999903678894,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10651","display_name":"IPv6, Mobility, Handover, Networks, Security","score":0.44269999861717224,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.41589999198913574,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.8032349944114685},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7615771293640137},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.6601734161376953},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5252416133880615},{"id":"https://openalex.org/keywords/trinoo","display_name":"Trinoo","score":0.49476832151412964},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4876817464828491},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.30999302864074707},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.15698421001434326},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.13151946663856506},{"id":"https://openalex.org/keywords/medicine","display_name":"Medicine","score":0.07753309607505798}],"concepts":[{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.8032349944114685},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7615771293640137},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.6601734161376953},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5252416133880615},{"id":"https://openalex.org/C43639116","wikidata":"https://www.wikidata.org/wiki/Q7843050","display_name":"Trinoo","level":5,"score":0.49476832151412964},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4876817464828491},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.30999302864074707},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.15698421001434326},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.13151946663856506},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.07753309607505798},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/netsoft64993.2025.11080537","is_oa":false,"landing_page_url":"https://doi.org/10.1109/netsoft64993.2025.11080537","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 11th International Conference on Network Softwarization (NetSoft)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":10,"referenced_works":["https://openalex.org/W2032885078","https://openalex.org/W2896320468","https://openalex.org/W3049187805","https://openalex.org/W3157317299","https://openalex.org/W4200436758","https://openalex.org/W4363678510","https://openalex.org/W4391519594","https://openalex.org/W4400236709","https://openalex.org/W4402264523","https://openalex.org/W4404400706"],"related_works":["https://openalex.org/W2783466926","https://openalex.org/W4286539397","https://openalex.org/W1968168724","https://openalex.org/W2204131204","https://openalex.org/W2754163055","https://openalex.org/W4322008378","https://openalex.org/W2383770723","https://openalex.org/W2186749541","https://openalex.org/W2360429410","https://openalex.org/W4256682929"],"abstract_inverted_index":{"DDoS":[0,53],"attacks":[1],"continue":[2],"to":[3,40,119,154,157],"grow":[4],"in":[5,14,71,160],"both":[6],"volume":[7],"and":[8,22,32,38,51,58,78,116,133,144],"complexity,":[9],"increasingly":[10],"exploiting":[11],"protocol-layer":[12],"vulnerabilities":[13],"core":[15],"Internet":[16],"protocols":[17],"such":[18,139],"as":[19,61,140],"NTP,":[20],"DNS,":[21],"HTTP/S.":[23],"Traditional":[24],"defense":[25,54],"mechanisms,":[26],"primarily":[27],"based":[28],"on":[29,74,106],"static":[30],"rules":[31],"signature-based":[33],"filtering,":[34],"have":[35],"limited":[36],"adaptability":[37],"struggle":[39],"handle":[41],"rapidly":[42],"evolving":[43,158],"attack":[44,76],"strategies.":[45],"This":[46,148],"research":[47],"proposes":[48],"a":[49],"protocol-aware":[50],"adaptive":[52,145],"framework":[55,129],"where":[56],"XDP/eBPF":[57,86],"LLMs":[59,103],"serve":[60],"modular,":[62],"complementary":[63],"components":[64],"that":[65],"can":[66],"be":[67],"deployed":[68],"individually":[69],"or":[70],"combination,":[72],"depending":[73],"the":[75,79,83,94,152],"scenario":[77],"specific":[80],"characteristics":[81],"of":[82],"target":[84],"protocol.":[85],"enables":[87],"high-performance,":[88],"lowlevel":[89],"packet":[90],"filtering":[91],"directly":[92],"at":[93],"NIC":[95],"level,":[96],"offering":[97],"efficient,":[98],"line-rate":[99],"mitigation":[100,137],"capabilities.":[101],"Meanwhile,":[102],"are":[104],"fine-tuned":[105],"structured":[107],"protocol":[108],"interaction":[109],"logs":[110],"(e.g.,":[111],"query":[112],"sequences,":[113],"entropy":[114],"shifts,":[115],"temporal":[117],"patterns)":[118],"detect":[120],"semantic-level":[121],"anomalies":[122],"beyond":[123],"traditional":[124],"detection":[125,131],"thresholds.":[126],"The":[127],"proposed":[128],"improves":[130],"accuracy":[132],"supports":[134],"dynamic,":[135],"context-sensitive":[136],"strategies,":[138],"real-time":[141],"traffic":[142],"throttling":[143],"rule":[146],"generation.":[147],"modular":[149],"design":[150],"allows":[151],"system":[153],"dynamically":[155],"adapt":[156],"threats":[159],"heterogeneous":[161],"networks.":[162]},"counts_by_year":[{"year":2025,"cited_by_count":3}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}