Availability stress analysis of DDoS traffic with implications for cryptocurrency infrastructure

In many cases, the first signs of a DDoS attack are not abnormal spikes in traffic but rather a distortion of the distribution of traffic at the flow level. This paper proposes a structural framework to measure the effects of such distortions on availability and proposes a composite measure called ASI to quantify the effect of availability stress on traffic. Using a real-world DDoS traffic dataset, the traffic is separated into attack and benign traffic, and the distribution of fifteen features at the flow level is analyzed. For each feature, several complementary stress components are analyzed, including central displacement, dispersion inflation, and heavy-tail amplification. These components are combined to compute the ASI to measure the effect of availability stress on traffic. The statistical significance of the distributional differences in the features is tested using the Mann–Whitney rank-sum test with false discovery rate corrections for multiple testing. The results indicate that the features of packet lengths and backward inter-arrival timings are most affected by availability stress, with several features showing extremely low p-values (< 10⁻3⁰). However, the results also indicate that while statistical separation of traffic is possible, structural availability stress is not necessarily implied. Instead, structural availability degradation is a result of the combined effect of timing irregularity and traffic activity bursts. The proposed framework is flexible and uses changes in the distribution of traffic features to measure availability stress and is applicable to both simulated and real-world traffic. The results indicate the structural traffic distortion approach can potentially identify early signs of availability degradation in availability-critical systems.