Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks, yet most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data. We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics: lag-1 autocorrelation of an aggregated flow signal and PCA cumulative explained variance. When the probes are inconclusive, the framework reserves a hybrid option as a future fallback rather than an empirically validated branch. Experiments on two statistically distinct datasets with Isolation Forest, One-Class SVM, and KMeans show that structural features consistently match or outperform temporal ones, with the performance gap widening as temporal dependence weakens.
@article{arxiv.2604.16575,
title = {Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic},
author = {Yasmin Souza Lima and Rodrigo Moreira and Larissa F. Rodrigues Moreira and Tereza Cristina M. de B. Carvalho and Flávio de Oliveira Silva},
journal= {arXiv preprint arXiv:2604.16575},
year = {2026}
}
Comments
Paper accepted for publication at Experimental Research Workshop on the Future Internet (2026) in conjunction with Brazilian Symposium on Computer Networks and Distributed Systems (2026)