Runtime DDoS Attack Detection Based on a Chunk-Optimized Transformer Model

• Gustavo F. Pereira UFMG
• Euclides Peres Farias Jr. UFPR
• Anderson Berganini de Neira UFMG / IFPR
• Michele Nogueira UFMG / UFPR

DOI: https://doi.org/10.5753/sbrc.2026.19870

Abstract

Distributed Denial of Service (DDoS) attacks are becoming increasingly faster to execute and more harmful. Thus, detecting them quickly becomes crucial. Solutions that employ robust AI models have inference times of several seconds or minutes in attack detection. This article proposes a DDoS attack detection method based on chunks with a Transformer architecture, enabling detection over network streams at runtime. The method captures traffic and processes it in time windows decomposed into smaller windows, reducing computational cost and classifying the window in a binary manner. In the experiments, the method achieved 99% accuracy, and the identification of malicious windows was performed in 35 ms.

References

Ali, M., Saleem, Y., Hina, S., and Shah, G. A. (2025). DDoSViT: IoT DDoS attack detection for fortifying firmware Over-The-Air (OTA) updates using vision transformer. Internet of Things, 30:101527.

Ashraf, J., Raza, G. M., Kim, B.-S., Wahid, A., and Kim, H.-Y. (2025). Making a real-time iot network intrusion-detection system (inids) using a realistic BoT-IoT dataset with multiple machine-learning classifiers. Applied Sciences (2076-3417), 15(4).

Dantas Silva, F. S., Silva, E., Neto, E. P., Lemos, M., Venancio Neto, A. J., and Esposito, F. (2020). A taxonomy of DDoS attack mitigation approaches featured by SDN technologies in iot scenarios. Sensors, 20(11):3078.

Farias, E. P., de Neira, A. B., Borges, L. F., and Nogueira, M. (2025). Transformers model for DDoS attack detection: A survey. Computer Networks, 270:111433.

Gcore (2025). Gcore successfully stops 6 tbps DDoS attack. Pico de 6 Tbps e 5,3 Bpps; ataque UDP; mitigado.

He, M., Zhao, X., and Wang, X. (2024). An efficient ddos detection method based on packet grouping via online data flow processing. IEEE Transactions on Sustainable Computing, 10(2):202–216.

Hernandez, D. V., Lai, Y.-K., and Ignatius, H. T. (2025). Real-time DDoS detection in high-speed networks: A deep learning approach with multivariate time series. Electronics, 14(13):2673.

Holdsworth, J. and Kosinski, M. (n.d.). O que é um ataque distributed denial-of-service (DDoS)? IBM Think.

Li, Y., Deng, X., Yang, A., and Gao, J. (2025). A transformer-based framework for DDoS attack detection via temporal dependency and behavioral pattern modeling. Algorithms, 18(10):628.

Mittal, M., Kumar, K., and Behal, S. (2023). Deep learning approaches for detecting DDoS attacks: A systematic review. Soft computing, 27(18):13039–13075.

Najar, A. A. and Manohar Naik, S. (2025). Ddos attack detection using cnn-bilstm with attention mechanism. Telematics and Informatics Reports, 18:100211.

Nalayini, C., Soumya, T., Lalitha, S., and Tamijetchelvy, R. (2025). A novel adaptive transformer based quantum intrusion detection system for software defined networks. Scientific Reports, 15(1):36505.

of the Republic of Lithuania, G. (2022). Intense DDoS attacks targeted several companies and institutions in lithuania.

Ullah, F., Ullah, S., Srivastava, G., and Lin, J. C.-W. (2024). IDS-INT: Intrusion detection system using transformer-based transfer learning for imbalanced network traffic. Digital Communications and Networks, 10(1):190–204.

Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, Ł., and Polosukhin, I. (2017). Attention is all you need. Advances in neural information processing systems, 30.

Wang, H. and Li, W. (2021). DDosTC: A transformer-based network attack detection hybrid mechanism in SDN. Sensors, 21(15):5047.

Wireshark (2026). tshark - The Wireshark Network Analyzer 3.2.2. Online documentation.