Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic
Authors: Yasmin Souza Lima, Rodrigo Moreira, Larissa F. Rodrigues Moreira, Tereza Cristina M. de B. Carvalho, Flávio de Oliveira Silva
Organizations: Institute of Exact and Technological Sciences Federal University of Viçosa (UFV) – MG – Brazil · University of São Paulo (USP) 05.508-010 – São Paulo – SP – Brazil · Department of Informatics – School of Engineering University of Minho (UMinho) – Braga – Portugal
Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks, yet most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data. We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics: lag-1 autocorrelation of an aggregated flow signal and PCA cumulative explained variance. When the probes are inconclusive, the framework reserves a hybrid option as a future fallback rather than an empirically validated branch. Experiments on two statistically distinct datasets with Isolation Forest, One-Class SVM, and KMeans show that structural features consistently match or outperform temporal ones, with the performance gap widening as temporal dependence weakens.