{"id":"https://openalex.org/W7155051147","doi":"https://doi.org/10.48550/arxiv.2604.16575","title":"Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic","display_name":"Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic","publication_year":2026,"publication_date":"2026-04-17","ids":{"openalex":"https://openalex.org/W7155051147","doi":"https://doi.org/10.48550/arxiv.2604.16575"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.16575","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.16575","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.16575","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134115452","display_name":"Yasmin Souza Lima","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lima, Yasmin Souza","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134103855","display_name":"Rodrigo Moreira","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Moreira, Rodrigo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125527239","display_name":"Larissa F. Rodrigues Moreira","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Moreira, Larissa F. Rodrigues","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134132646","display_name":"Tereza Cristina M. de B. Carvalho","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Carvalho, Tereza Cristina M. de B.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5134118444","display_name":"Fl\u00e1vio de Oliveira Silva","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Silva, Fl\u00e1vio de Oliveira","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8219000101089478,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8219000101089478,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.0544000007212162,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.02019999921321869,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.829800009727478},{"id":"https://openalex.org/keywords/autocorrelation","display_name":"Autocorrelation","score":0.5259000062942505},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.47589999437332153},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.44350001215934753},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.4372999966144562},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.3736000061035156},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.33559998869895935},{"id":"https://openalex.org/keywords/pattern-detection","display_name":"Pattern detection","score":0.328000009059906}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.829800009727478},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7156000137329102},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5953999757766724},{"id":"https://openalex.org/C5297727","wikidata":"https://www.wikidata.org/wiki/Q786970","display_name":"Autocorrelation","level":2,"score":0.5259000062942505},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.47589999437332153},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4747999906539917},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.44350001215934753},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.4372999966144562},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3736000061035156},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.33559998869895935},{"id":"https://openalex.org/C2776088427","wikidata":"https://www.wikidata.org/wiki/Q378859","display_name":"Pattern detection","level":2,"score":0.328000009059906},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.32100000977516174},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.31310001015663147},{"id":"https://openalex.org/C77277458","wikidata":"https://www.wikidata.org/wiki/Q1969246","display_name":"Temporal database","level":2,"score":0.3046000003814697},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.2953000068664551},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.289000004529953},{"id":"https://openalex.org/C203595873","wikidata":"https://www.wikidata.org/wiki/Q25389927","display_name":"Change detection","level":2,"score":0.28859999775886536},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.274399995803833},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C151406439","wikidata":"https://www.wikidata.org/wiki/Q186588","display_name":"Time series","level":2,"score":0.26829999685287476},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.26109999418258667},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.2572999894618988},{"id":"https://openalex.org/C87007009","wikidata":"https://www.wikidata.org/wiki/Q210832","display_name":"Statistical hypothesis testing","level":2,"score":0.25270000100135803}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.16575","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.16575","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.16575","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.16575","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Unsupervised":[0],"anomaly":[1],"detection":[2],"is":[3],"widely":[4],"used":[5],"to":[6],"detect":[7],"Distributed":[8],"Denial-of-Service":[9],"(DDoS)":[10],"attacks":[11],"in":[12],"cloud-native":[13],"5G":[14],"networks,":[15],"yet":[16],"most":[17],"studies":[18],"assume":[19],"a":[20,39,74,78],"fixed":[21],"traffic":[22],"representation,":[23],"either":[24],"temporal":[25,45,108,116],"or":[26,46,106],"structural,":[27],"without":[28],"validating":[29],"which":[30],"feature":[31],"space":[32],"best":[33],"matches":[34],"the":[35,67,71,111],"data.":[36],"We":[37],"propose":[38],"lightweight":[40],"decision":[41],"framework":[42,72],"that":[43,101],"prioritizes":[44],"structural":[47,102],"features":[48,103],"before":[49],"training,":[50],"using":[51],"two":[52,89],"diagnostics:":[53],"lag-1":[54],"autocorrelation":[55],"of":[56],"an":[57,83],"aggregated":[58],"flow":[59],"signal":[60],"and":[61,98],"PCA":[62],"cumulative":[63],"explained":[64],"variance.":[65],"When":[66],"probes":[68],"are":[69],"inconclusive,":[70],"reserves":[73],"hybrid":[75],"option":[76],"as":[77,115],"future":[79],"fallback":[80],"rather":[81],"than":[82],"empirically":[84],"validated":[85],"branch.":[86],"Experiments":[87],"on":[88],"statistically":[90],"distinct":[91],"datasets":[92],"with":[93,110],"Isolation":[94],"Forest,":[95],"One-Class":[96],"SVM,":[97],"KMeans":[99],"show":[100],"consistently":[104],"match":[105],"outperform":[107],"ones,":[109],"performance":[112],"gap":[113],"widening":[114],"dependence":[117],"weakens.":[118]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-04-22T00:00:00"}