A Dual-Pillar Framework for DDoS Detection: Kinematic Early Warning Signals and 2D Haar Wavelet Machine Learning

Distributed Denial of Service (DDoS) attacks can exhaust network resources within seconds, making early and accurate detection a critical requirement. Most existing systems are reactive—they trigger alerts only after a volumetric threshold is already breached. In this paper, we present a feasibility study of a two-component detection architecture, evaluating each component independently on the CICDDoS2019 benchmark. Pillar 1 is a kinematic Early Warning System (EWS) that models mean-centered aggregate traffic using a discrete-time relationship inspired by second-order Ordinary Differential Equations (ODEs), computed through strictly causal backward finite differences at 1-second intervals. Pillar 2 is a flow classifier that takes 58 Lasso-selected features, reshapes them into an 8x8 matrix, applies a deterministic 2D Haar wavelet transform, and classifies the resulting multiscale coefficients using an Extra Trees ensemble. On the evaluated capture, Pillar 1 flagged a pre-injection statistical anomaly 4,956 seconds before documented attack injection—an observation that demonstrates statistical deviation from the benign baseline rather than a validated prediction of an impending attack. Evaluated separately, Pillar 2 achieved 99.242–99.255% accuracy across four test arrangements from the same capture, retaining 99.959% accuracy against a 99.980% raw-feature baseline in a controlled ablation. We detail the mathematical formulation, sensitivity checks, and archival limitations of these experiments, and outline the deduplicated cross-dataset benchmarks and pipeline integration needed for operational validation.