{
  "schema_version": "0.6.0",
  "paper_id": "anomaly-detection-ddos-attacks-cloud-environment",
  "page_url": "https://threadslab.org/research-publications/papers/anomaly-detection-ddos-attacks-cloud-environment/",
  "title": "The Use of Anomaly Detection for the Detection of Different Types of DDoS Attacks in Cloud Environment",
  "title_variants": [],
  "authors": [
    "Hossein Abbasi",
    "Naser Ezzati-Jivan",
    "Martine Bellaiche",
    "Chamseddine Talhi",
    "Michel R. Dagenais"
  ],
  "author_details": [
    {
      "name": "Hossein Abbasi",
      "orcid": "https://orcid.org/0000-0002-4024-4355",
      "profile_url": "https://dblp.org/pid/241/6443.html"
    },
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://threadslab.org/"
    },
    {
      "name": "Martine Bellaiche",
      "orcid": null,
      "profile_url": "https://dblp.org/pid/06/7909.html"
    },
    {
      "name": "Chamseddine Talhi",
      "orcid": null,
      "profile_url": "https://dblp.org/pid/63/6619.html"
    },
    {
      "name": "Michel R. Dagenais",
      "orcid": null,
      "profile_url": "https://dblp.org/pid/60/309.html"
    }
  ],
  "publication": {
    "year": 2021,
    "venue": "Journal of Hardware and Systems Security",
    "type": "journal article",
    "publication_date": "2021-10-16",
    "online_date": "2021-10-16",
    "print_date": "2021-12",
    "volume": "5",
    "issue": "3-4",
    "pages": "208-222",
    "article_number": null,
    "publisher": "Springer Science and Business Media LLC",
    "issn": [
      "2509-3428",
      "2509-3436"
    ],
    "isbn": [],
    "crossref_type": "journal-article"
  },
  "publication_type": "journal article",
  "status": "published_with_public_preview",
  "canonical_source_url": "https://doi.org/10.1007/s41635-021-00119-z",
  "source_record_id": "the-use-of-anomaly-detection-for-the-detection-of-different-types-of-ddos-attacks-in-cloud-envir-ba1d631919",
  "identifiers": {
    "doi": "10.1007/s41635-021-00119-z"
  },
  "abstract": "The accessible Springer preview associates the paper with a unified anomaly-detection approach for bandwidth-, application-, and connection-exhaustion DDoS groups, using CUSUM-style change detection and representative HTTP, database/application, and TCP SYN-flood attacks.",
  "abstract_source": "Springer two-page preview, paraphrased; complete article not obtained.",
  "abstract_available": true,
  "scholar_eligibility": {
    "eligible": false,
    "basis": "not-eligible",
    "note": "The page is a discovery record; it does not claim Google Scholar article-host eligibility."
  },
  "description": "The accessible Springer preview associates the paper with a unified anomaly-detection approach for bandwidth-, application-, and connection-exhaustion DDoS groups, using CUSUM-style change detection and representative HTTP, database/application, and TCP SYN-flood attacks.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-26",
    "sources": [
      {
        "note": "Local PDF reviewed, including the testbed, feature definitions, CUSUM/bootstrap procedure, and attack case studies"
      },
      {
        "note": "Springer article DOI: https://doi.org/10.1007/s41635-021-00119-z"
      },
      {
        "note": "Public PDF supplied for evidence review: https://link.springer.com/content/pdf/10.1007/s41635-021-00119-z.pdf"
      }
    ]
  },
  "summary": {
    "core_contribution": "The paper proposes a cloud-side anomaly detector that combines traffic, virtual-machine resource, and kernel-level indicators to identify several DDoS classes through change-point evidence.",
    "problem": "Cloud DDoS and economic-denial-of-sustainability attacks can consume bandwidth, application capacity, connections, or billable resources while their packets may resemble legitimate traffic. A detector based on a single network metric can therefore miss the resource-side manifestation of an attack.",
    "method": "The evaluation covers HTTP bandwidth abuse, database/application abuse, and TCP SYN flooding in a QEMU 2.0.0-rc1/KVM testbed with an Httpd 2.2 VM and MySQL 5.6.16. The detector monitors traffic and resource indicators such as CPU wait/use, memory, disk and network I/O, process counts, hop counts, and SYN/ACK ratios. It applies CUSUM change-point detection and bootstrap-based confidence assessment with 1,000 random reorderings; state parameters are aggregated into an attack-likelihood score.",
    "findings": "CUSUM makes the traffic/resource shifts more visible than the raw time series in the reported HTTP and database cases, with change regions identified around the stated test intervals. The unified feature view distinguishes the three evaluated attack families and is argued to provide earlier cloud-side warning than relying only on a signature detector such as Snort. The paper does not provide a broad modern benchmark of false-positive and false-negative rates.",
    "limitations": "The study is a synthetic virtualized testbed with three representative attack types and selected normal-traffic generators. The comparisons with Snort and machine-learning approaches are primarily qualitative, and the paper does not establish generalization to contemporary encrypted traffic, multi-tenant orchestration, or a large operational corpus.",
    "future_work": "Extend the detector to UDP and application-specific attacks, evaluate calibrated thresholds and supervised/unsupervised hybrids, measure detection delay and error rates on public and operational traces, and connect detection to validated mitigation without disrupting legitimate tenants."
  },
  "tags": [
    "anomaly-detection",
    "machine-learning",
    "resource-analysis",
    "performance-analysis"
  ],
  "keywords": [
    "DDoS attacks",
    "cloud environment",
    "CUSUM",
    "bandwidth exhaustion",
    "application exhaustion",
    "connection exhaustion",
    "anomaly detection"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "The Use of Anomaly Detection for the Detection of Different Types of DDoS Attacks in Cloud Environment",
      "url": "https://doi.org/10.1007/s41635-021-00119-z",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "springer-two-page-preview",
      "label": "Springer two-page preview",
      "relation": "source-record",
      "title": "The Use of Anomaly Detection for the Detection of Different Types of DDoS Attacks in Cloud Environment",
      "url": "https://page-one.springer.com/pdf/preview/10.1007/s41635-021-00119-z",
      "pdf_url": null,
      "status": "public_preview",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_with_public_preview",
    "note": "The DOI and article identity are verified, but the authorized public Springer route exposed only a two-page preview rather than the complete article. The preview identifies bandwidth-, application-, and connection-exhaustion groups, CUSUM, and representative attack classes; no full-paper metric is asserted.",
    "license": null
  },
  "resources": {
    "code": null,
    "data": null,
    "slides": null,
    "demo": null
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when your work detects cloud DDoS behavior from joint traffic, VM-resource, and kernel/resource anomalies.",
    "points": [
      "CUSUM change-point detection with bootstrap confidence assessment.",
      "Unified indicators for HTTP, database/application, and TCP SYN attack cases.",
      "Cloud-side resource evidence that complements packet/signature detectors.",
      "A virtualized testbed baseline, with its limited attack diversity stated explicitly."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-26",
    "metadata_source": [
      "Local PDF reviewed, including the testbed, feature definitions, CUSUM/bootstrap procedure, and attack case studies",
      "Springer article DOI: https://doi.org/10.1007/s41635-021-00119-z",
      "Public PDF supplied for evidence review: https://link.springer.com/content/pdf/10.1007/s41635-021-00119-z.pdf"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-28"
  }
}