A Dual-Pillar Framework for DDoS Detection: Kinematic Early Warning Signals and 2D Haar Wavelet Machine Learning
- 1VNR Vignana Jyothi Institute of Engineering and Technology
Abstract
Distributed Denial of Service (DDoS) attacks can exhaust network resources within seconds, making early and accurate detection a critical requirement. Most existing systems are reactive—they trigger alerts only after a volumetric threshold is already breached. In this paper, we present a feasibility study of a two-component detection architecture, evaluating each component independently on the CICDDoS2019 benchmark. Pillar 1 is a kinematic Early Warning System (EWS) that models mean-centered aggregate traffic using a discrete-time relationship inspired by second-order Ordinary Differential Equations (ODEs), computed through strictly causal backward finite differences at 1-second intervals. Pillar 2 is a flow classifier that takes 58 Lasso-selected features, reshapes them into an 8x8 matrix, applies a deterministic 2D Haar wavelet transform, and classifies the resulting multiscale coefficients using an Extra Trees ensemble. On the evaluated capture, Pillar 1 flagged a pre-injection statistical anomaly 4,956 seconds before documented attack injection—an observation that demonstrates statistical deviation from the benign baseline rather than a validated prediction of an impending attack. Evaluated separately, Pillar 2 achieved 99.242–99.255% accuracy across four test arrangements from the same capture, retaining 99.959% accuracy against a 99.980% raw-feature baseline in a controlled ablation. We detail the mathematical formulation, sensitivity checks, and archival limitations of these experiments, and outline the deduplicated cross-dataset benchmarks and pipeline integration needed for operational validation.
Related
- Machine Learning-Based Fatigue Detection from EEG Signals: A Methodological Pilot Framework with Potential for Nursing Applications
- MDT-HMTL: A Multidimensional Temporal Hierarchical Multi-Task Learning Framework for Myocardial Infarction Detection and State Classification Using PPG Signals
- An explainable machine-learning framework for seasonal early warning of West Nile virus using predictive climate data
- Machine Learning Detection of Peritoneal Entry from Vibroacoustic Signals During Veress Needle Insertion
- Deep Learning Detection of Beyond-General-Relativity Deviations in Gravitational-Wave Signals: A Detection-Threshold Study with Real LIGO Noise
BibTeX
@misc{madireddy2026dualpillar,
title = {{A Dual-Pillar Framework for DDoS Detection: Kinematic Early Warning Signals and 2D Haar Wavelet Machine Learning}},
author = {Harshith Reddy Madireddy and Shanmukhi Kurapati and Sai Harsha Vardhan K and Hussain M.K and RadhaKrishna V},
howpublished = {Zenodo},
year = {2026},
month = oct,
doi = {10.5281/zenodo.23671072},
url = {https://zenodo.org/records/23671072},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - A Dual-Pillar Framework for DDoS Detection: Kinematic Early Warning Signals and 2D Haar Wavelet Machine Learning
AU - Harshith Reddy Madireddy
AU - Shanmukhi Kurapati
AU - Sai Harsha Vardhan K
AU - Hussain M.K
AU - RadhaKrishna V
PY - 2026
DA - 2026/10/26
PB - Zenodo
DO - 10.5281/zenodo.23671072
UR - https://zenodo.org/records/23671072
AB - Distributed Denial of Service (DDoS) attacks can exhaust network resources within seconds, making early and accurate detection a critical requirement. Most existing systems are reactive—they trigger alerts only after a volumetric threshold is already breached. In this paper, we present a feasibility study of a two-component detection architecture, evaluating each component independently on the CICDDoS2019 benchmark. Pillar 1 is a kinematic Early Warning System (EWS) that models mean-centered aggregate traffic using a discrete-time relationship inspired by second-order Ordinary Differential Equations (ODEs), computed through strictly causal backward finite differences at 1-second intervals. Pillar 2 is a flow classifier that takes 58 Lasso-selected features, reshapes them into an 8x8 matrix, applies a deterministic 2D Haar wavelet transform, and classifies the resulting multiscale coefficients using an Extra Trees ensemble. On the evaluated capture, Pillar 1 flagged a pre-injection statistical anomaly 4,956 seconds before documented attack injection—an observation that demonstrates statistical deviation from the benign baseline rather than a validated prediction of an impending attack. Evaluated separately, Pillar 2 achieved 99.242–99.255% accuracy across four test arrangements from the same capture, retaining 99.959% accuracy against a 99.980% raw-feature baseline in a controlled ablation. We detail the mathematical formulation, sensitivity checks, and archival limitations of these experiments, and outline the deduplicated cross-dataset benchmarks and pipeline integration needed for operational validation.
ER -