Estimation is Not Enough: Carpet-Bombing Detection via Per-Packet Uniformity Testing
SweepSketch detects carpet-bombing DDoS in milliseconds on Tofino2 using 44-byte buckets and no source state.
Carpet-bombing spreads traffic across destination prefixes so each host stays below alarms while prefix-level defenses are exhausted. SweepSketch is a destination-side sketch with no source state, packing a tagged self-cleaning T-HLL, per-packet CUSUM decisions, and dual-EWMA gates into 44-byte buckets on the Tofino2 switch. Under the same memory budget it led 10 baselines with F1 0.991 and median alarm latency of 186-627 ms. On 30 held-out real and synthetic multi-prefix samples it detected all 140 victim prefixes and is structurally immune to source spoofing.
- Carpet bombing stays under per-host alarms while exhausting prefix defenses.
- SweepSketch stores no source state in 44-byte Tofino2 buckets.
- It led 10 baselines with F1 of 0.991 under equal memory.
- Median alarm latency was 186 to 627 milliseconds.
- Held-out tests detected all 140 victim prefixes.
Full article194 words · extracted from arxiv.org · click to collapse
Carpet-bombing attacks spread traffic uniformly across one or more destination IP prefixes, keeping every host in the prefix below alarm thresholds while exhausting prefix-level defenses. Existing carpet-bombing detectors run at seconds-to-minutes latency, too slow to respond within the attack window. Sketches support per-packet processing in fixed-width memory, a natural fit for cutting latency, yet no sketch-based detector exists for carpet bombing. Because source addresses can be spoofed, and attacks can be launched through reflection, source-side evidence is structurally unavailable and detection must anchor at the destination side. We present SweepSketch, the first sketch-based detection model for carpet bombing: it anchors at the destination, keeps no source state, and compresses a tagged self-cleaning T-HLL primitive, per-packet CUSUM decisions, and dual-EWMA change gates into 44-byte fixed-width buckets deployable on the Tofino2 programmable switch. Its design is supported by six theorems, including verifiable detection lower bounds. Under the same memory budget, SweepSketch leads all 10 baselines across the sketch, entropy, and sequential-testing classes in F1 (0.991). Its median alarm latency is 186--627 ms, and it has structural immunity to source spoofing. On 30 real/synthetic multi-prefix samples held out from parameter design, it detects all 140 victim prefixes.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.33308