Distributed Pulse-Wave Simulator for DDoS Dataset Generation

2025-11-16

AI Summary

Distributed pulse-wave DDoS attacks exhibit transient behavior, spatiotemporal synchronization, and cross-domain distribution, enabling evasion of conventional detection methods and lacking publicly available multi-domain evolutionary datasets. Method: We present the first open-source distributed pulse-wave DDoS traffic simulator, implemented in ns-3 to enable coordinated modeling across multiple autonomous systems (ASes). It supports MPI-based parallel simulation and YAML-driven fine-grained attack configuration. Innovatively integrating multi-point synchronized packet capture and a custom scheduling module, it generates reproducible, multi-perspective datasets exhibiting natural fingerprint variation. Contribution/Results: This work fills a critical gap in distributed pulse-wave attack data. Empirical evaluation confirms statistically significant inter-domain fingerprint divergence—even under identical aggregate traffic rates—enabling robust early detection, forensic attribution, and evaluation of distributed defense mechanisms. The simulator establishes a benchmark platform and provides a scalable, synchronized simulation framework for research and development.

Technology Category

• Search and Optimization: Distributed Search
• Multiagent Systems: Agent-Based Simulation and Emergent Behavior
• Constraint Satisfaction and Optimization: Distributed CSP/Optimization

Application Category

• Web Mining and Content Analysis: Web data generation and simulation
• Systems and Infrastructure for Web, Mobile and WoT: Data management and stream processing for Web, mobile and wireless applications
• Security and Privacy: Large-scale security measurements

Abstract

Pulse-wave Distributed Denial-of-Service (DDoS) attacks generate short, synchronized bursts of traffic that circumvent pattern-based detection and quickly exhaust traditional defense systems. This transient and spatially distributed behavior makes analysis extremely challenging, as no public datasets capture how such attacks evolve across multiple network domains. Since each domain observes only a partial viewpoint of the attack, a correlated, multi-vantage view is essential for comprehensive analysis, early detection, and attribution. This paper presents DPWS, an open-source simulator for generating distributed pulse-wave DDoS datasets. DPWS models multi-AS topologies and produces synchronized packet captures at multiple autonomous systems, showing the distributed structure of coordinated bursts. It enables fine-grained control of traffic parameters through a lightweight YAML interface. DPWS reproduces pulse-wave dynamics across multiple vantage points, exhibits natural fingerprint variability at equal aggregate rates, and scales with MPI in ns-3, providing a reproducible basis for studying pulse-wave behaviour and benchmarking distributed DDoS defenses, while sharing practical insights on ns-3 scalability and synchronization gained during development.

Problem

• Generating datasets for distributed pulse-wave DDoS attacks
• Capturing synchronized multi-domain attack evolution patterns
• Enabling analysis of transient traffic bursts across networks

Innovation

• Simulates multi-AS topologies for synchronized packet captures
• Uses YAML interface for fine-grained traffic parameter control
• Scales with MPI in ns-3 to reproduce distributed pulse-wave dynamics