NAISS
SUPR
NAISS Projects
SUPR
WASP-Yinuo Zhang
Dnr:

NAISS 2026/4-963

Type:

NAISS Small

Principal Investigator:

Yinuo Zhang

Affiliation:

Umeå universitet

Start Date:

2026-06-01

End Date:

2027-06-01

Primary Classification:

10211: Security, Privacy and Cryptography

Allocation

Abstract

Distributed Denial-of-Service (DDoS) attacks remain a major threat to modern cloud and edge infrastructures, where services must maintain high availability under dynamic and large-scale workloads. Recent deep learning–based DDoS detection methods have achieved strong performance on benchmark datasets; however, their robustness often degrades under distribution shifts. Models trained on one dataset frequently fail to generalize to traffic collected from different network environments, infrastructures, or previously unseen attack behaviors. This project addresses a critical challenge in current DDoS research: the lack of systematic methodologies for evaluating and improving cross-domain robustness. We investigate synthetic traffic generation as a controlled framework for studying model behavior under realistic distribution shifts. By generating diverse and configurable traffic patterns, synthetic data enables controlled experiments that are difficult to achieve using limited real-world datasets alone. In addition, the project explores emerging security risks associated with agentic systems, including the possibility of autonomous agents coordinating resource-exhaustion behaviors that resemble DDoS attacks in cloud-edge environments. We aim to study how AI-driven agents may unintentionally or maliciously amplify traffic generation and system overload, and how detection models can remain robust under these evolving attack patterns. The central research question is: Can synthetic traffic generation improve the cross-domain robustness of DDoS detection models under both conventional and agent-driven attack scenarios? To answer this question, we will evaluate detection performance across real and synthetic environments, analyze generalization gaps under distribution shifts, and investigate training strategies that improve robustness and transferability. The Arrhenius supercomputing system provides the computational resources necessary to train large-scale generative models, generate high-fidelity synthetic network traffic, simulate complex agentic attack behaviors in controlled environments, and conduct extensive cross-domain evaluation experiments.