Distributed Pulse-Wave Simulator for DDoS Dataset Generation

TL;DR

This paper introduces DPWS, an open-source distributed pulse-wave DDoS simulator that generates synchronized, multi-vantage point datasets to aid in analysis, detection, and defense benchmarking of complex attack patterns.

Contribution

The paper presents a novel simulator, DPWS, capable of modeling multi-AS pulse-wave DDoS attacks with synchronized data across multiple vantage points, enabling better analysis and defense testing.

Findings

DPWS accurately reproduces pulse-wave attack dynamics across multiple vantage points.

DPWS exhibits natural fingerprint variability at the same aggregate rates.

DPWS scales effectively with MPI in ns-3, supporting large-scale simulations.

Abstract

Pulse-wave Distributed Denial-of-Service (DDoS) attacks generate short, synchronized bursts of traffic that circumvent pattern-based detection and quickly exhaust traditional defense systems. This transient and spatially distributed behavior makes analysis extremely challenging, as no public datasets capture how such attacks evolve across multiple network domains. Since each domain observes only a partial viewpoint of the attack, a correlated, multi-vantage view is essential for comprehensive analysis, early detection, and attribution. This paper presents DPWS, an open-source simulator for generating distributed pulse-wave DDoS datasets. DPWS models multi-AS topologies and produces synchronized packet captures at multiple autonomous systems, showing the distributed structure of coordinated bursts. It enables fine-grained control of traffic parameters through a lightweight YAML interface. DPWS reproduces pulse-wave dynamics across multiple vantage points, exhibits natural fingerprint variability at equal aggregate rates, and scales with MPI in ns-3, providing a reproducible basis for studying pulse-wave behaviour and benchmarking distributed DDoS defenses, while sharing practical insights on ns-3 scalability and synchronization gained during development.