Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic - Lima, Yasmin Souza; Moreira, Rodrigo; Moreira, Larissa F. Rodrigues; Carvalho, Tereza Cristina M. de B.; Silva, Flávio de Oliveira (Anais do Workshop de Pesquisa Experimental da Internet do Futuro (WPEIF); 2026: Anais do XVII Workshop de Pesquisa Experimental da Internet do FuturoDO - 10.5753/wpeif.2026.22867, 2026)
Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks, yet most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data. We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics: lag-1 autocorrelation of an aggregated flow signal and PCA cumulative explained variance. When the probes are inconclusive, the framework reserves a hybrid option as a future fallback rather than an empirically validated branch. Experiments on two statistically distinct datasets with Isolation Forest, One-Class SVM, and KMeans show that structural features consistently match or outperform temporal ones, with the performance gap widening as temporal dependence weakens.