# Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic

arXiv: https://arxiv.org/abs/2604.16575 · HTML: https://mlsanity.com/paper/2604.16575/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 2 of its 14 references that are in the map.
- First posted on arXiv 17 Apr 2026.

## Builds on (most cited first, 2 of 2)

- [Calibrated One-class Classification for Unsupervised Time Series Anomaly Detection](https://mlsanity.com/paper/2207.12201/) (2022)
- [Silent Failures in Stateless Systems: Rethinking Anomaly Detection for Serverless Computing](https://mlsanity.com/paper/2507.04969/) (2025)

## Abstract (arXiv)

Unsupervised anomaly detection is widely used to detect Distributed Denial-of-Service (DDoS) attacks in cloud-native 5G networks, yet most studies assume a fixed traffic representation, either temporal or structural, without validating which feature space best matches the data. We propose a lightweight decision framework that prioritizes temporal or structural features before training, using two diagnostics: lag-1 autocorrelation of an aggregated flow signal and PCA cumulative explained variance. When the probes are inconclusive, the framework reserves a hybrid option as a future fallback rather than an empirically validated branch. Experiments on two statistically distinct datasets with Isolation Forest, One-Class SVM, and KMeans show that structural features consistently match or outperform temporal ones, with the performance gap widening as temporal dependence weakens.