DELP-Net: A Differentiable Entropy Layer Pyramid Network for End-to-End Low-Rate DoS Detection

TL;DR

DELP-Net is a new network designed to detect stealthy low-rate denial-of-service attacks by analyzing traffic patterns using entropy-based methods.

Contribution

The novel DELP-Net uses a differentiable entropy layer pyramid and attention mechanism for effective low-rate DoS detection.

Findings

DELP-Net achieved an average F1 score of 0.9877 across six LDoS attack types.

The model demonstrated a detection rate of 98.69% and a false-positive rate of 1.15%.

It effectively captures weak repetitive patterns in LDoS traffic using entropy-driven methods.

Abstract

Low-rate Denial-of-Service (LDoS) attacks exploit periodic traffic pulses to trigger congestion while maintaining a low average rate, making them highly stealthy and difficult to distinguish from legitimate bursty traffic using threshold-based or simple statistical detectors. To address this challenge, this paper proposes DELP-Net, an end-to-end Differentiable Entropy Layer Pyramid Network for window-level online LDoS detection directly from raw traffic. DELP-Net combines a multi-scale one-dimensional convolutional pyramid with a differentiable Rényi-entropy-driven attention mechanism to capture distributional regularity and weak repetitive patterns characteristic of LDoS traffic. In addition, an entropy-conditioned temporal convolutional network is employed to model cross-window periodic dependencies in a lightweight manner, together with an entropy-regularized hybrid loss to enhance robustness under complex background traffic. Experiments on the low-rate DoS dataset show that DELP-Net achieves an average F1 score of 0.9877 across six LDoS attack types, with a detection rate of 98.69% and a false-positive rate of 1.15%, demonstrating its effectiveness and suitability for practical online intrusion detection deployments.

Figures