Unsupervised DDoS Detection in High-Speed Networks: An Evaluation Using Real Transit Provider Data - Chianfa, Murilo A.; Miani, Rodrigo S.; Zarpelão, Bruno B. (Anais do Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), 2026)
Distributed denial-of-service (DDoS) attack detection has been widely studied in the past decade by academia. Despite progress having been made, recent surveys show that detection in environments such as Internet Transit Providers (ITP) remains challenging due to high-speed constraints. This study evaluates four anomaly detection algorithms, namely Autoencoder, Isolation Forest, Local Outlier Factor, and One Class Support Vector Machine, using three datasets collected from operational ITPs during confirmed DDoS attacks. The evaluation considers four temporal aggregation windows and three feature selection configurations, with the objective of analyzing the predictive capacity of the algorithms under different temporal and feature selection settings. The results show that the Autoencoder detection achieved the best results when using the most aggressive feature selection configuration and the shortest temporal aggregation windows.