Hierarchical Flow-Based Ddos Detection Without Protocol Identifiers: a Two-Stage Framework for Attack Identification and Flood Type Distinction

Detecting Distributed Denial-of-Service (DDoS) attacks has become increasingly challenging due to the difficulties in identifying encrypted, protocol-obscured, and diverse traffic patterns, especially within the 5G and V2X paradigms; this is particularly true for existing detection mechanisms that rely on recognizing the protocols used by attacking flows and inspecting payloads, all while prioritizing user privacy in 5G networks. In this context, this paper presents a two-stage hierarchical detection framework for the detection of flooding attacks, relying solely on the use of the statistics associated with the behavior of the flows. In the first stage, the detection of the benign and attacking flows is conducted by an XGBoost classifier, achieving an accuracy of 99%, while the detection of the TCP SYN floods from the UDP floods is conducted by a heavily regularized Extra Trees ensemble, achieving an accuracy of 81.67%. Furthermore, the evaluation of the detection framework, which is based on a collection of 6.5 million flows from a realistic 5G-V2X testbed, highlights the feasibility of protocol-independent detection, especially given the extreme class imbalance and the assumption of encrypted traffic, thereby demonstrating the presence of intrinsic behavioral invariants that are sufficient for developing an effective DDoS detection framework.