Availability Stress Analysis of DDoS Traffic Affecting Cryptocurrency Infrastructure

Availability Stress Analysis of DDoS Traffic Affecting Cryptocurrency Infrastructure | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Availability Stress Analysis of DDoS Traffic Affecting Cryptocurrency Infrastructure Muhammad Zeshan Arshad, Ali Algarni This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8821541/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 13 You are reading this latest preprint version Abstract Before noticeable symptoms like service outages or packet loss emerge, distributed denial of service (DDoS) assaults may impact network availability. The most common symptom, rather than sudden, glaring anomalies, is the slow distorting of traffic patterns at the flow level. In this study, we used a modelling framework that simulates these effects to look at actual DDoS dataset Internet traffic. Starting with a separation of attack traffic from benign traffic, we compare the distributions of fifteen flow-level features. For each feature, we monitor three different types of stress: central displacement, dispersion, and heavy upper tails. Central displacement is the movement of the distribution's center, while dispersion is the inflation of the distribution. Heavy upper tails are the amplification of the extremes. The end result of integrating these components is the Availability Stress Index (ASI). We assess the statistical significance of the differences using the Mann-Whitney rank-sum test, which corrects false discovery rate in multiple comparisons. Assaults put the most strain on packet-length and backward inter-arrival time-related properties. There seems to be a significant statistical difference between several of these variables, as their adjusted p-values are less than 10 -30 . Considering the cumulative effects, we can no longer pin the decline in availability on a particular factor. The combination of random timing with bursts of high activity, however, is what really stands out. It is worth mentioning that this system is independent of static thresholds and pre-trained models. Its only premise is that, during an assault, the distribution of traffic characteristics changes. Important for availability-critical network services, this enables ASI to detect, in both real-world and simulated scenarios, the traffic components linked to long-term availability stress. DDoS attack analysis Network availability Nonparametric statistical analysis Packet length distribution Inter arrival time Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Editorial decision: Revision requested 01 Mar, 2026 Reviews received at journal 26 Feb, 2026 Reviews received at journal 26 Feb, 2026 Reviewers agreed at journal 24 Feb, 2026 Reviewers agreed at journal 24 Feb, 2026 Reviews received at journal 16 Feb, 2026 Reviewers agreed at journal 16 Feb, 2026 Reviewers agreed at journal 13 Feb, 2026 Reviewers agreed at journal 13 Feb, 2026 Reviewers invited by journal 13 Feb, 2026 Editor assigned by journal 09 Feb, 2026 Submission checks completed at journal 09 Feb, 2026 First submitted to journal 08 Feb, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8821541","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":592022589,"identity":"4e566f2e-b75f-435e-adb8-4f900e0df600","order_by":0,"name":"Muhammad Zeshan Arshad","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABA0lEQVRIiWNgGAWjYDAC5gNgKgFMMjYwyBlAaDyALQFVizHpWhI3ENJicIyBdeOPiro8/tnNzz7+3GGXvl368MGPM9sY5Plx6ANqYbshceZwscSdY8azec8k5+7sS0uW3NjGYDjjAHYtkvMb2G4Yth1IbLiRYMzM2Macu+EMjxnjwzagU3FpaQPakvivLnH+jfTPjD/b6tMNYFrkcWjhZwNqOdjAnLjhRo4xA2/b4QSwFqDDEgzwaLnZcOxw4sYbOcXMvG3HDXf2sCVLzjgnYbgRhxY2kJYfNXWJ826kbwY6rFrenIf54MeeMht5ORxagPZ8wCosgUv9KBgFo2AUjAIiAACVk16O2EDFJQAAAABJRU5ErkJggg==","orcid":"","institution":"Brock University","correspondingAuthor":true,"prefix":"","firstName":"Muhammad","middleName":"Zeshan","lastName":"Arshad","suffix":""},{"id":592022590,"identity":"a5846030-ff5b-4213-a945-caec00722f34","order_by":1,"name":"Ali Algarni","email":"","orcid":"","institution":"King Abdulaziz University","correspondingAuthor":false,"prefix":"","firstName":"Ali","middleName":"","lastName":"Algarni","suffix":""}],"badges":[],"createdAt":"2026-02-08 12:38:20","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8821541/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8821541/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":103049350,"identity":"32510dd6-8dff-4252-a7a5-f8d190c5d2f4","added_by":"auto","created_at":"2026-02-20 07:40:09","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":525907,"visible":true,"origin":"","legend":"","description":"","filename":"AmendmentCyberBlockchain.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8821541/v1_covered_6b342fdb-f83d-4821-9aea-59a8e7d71987.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Availability Stress Analysis of DDoS Traffic Affecting Cryptocurrency Infrastructure","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"journal-of-king-saud-university-computer-and-information-sciences","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [Journal of King Saud University Computer and Information Sciences](https://link.springer.com/journal/44443)","snPcode":"44443","submissionUrl":"https://submission.springernature.com/new-submission/44443/3","title":"Journal of King Saud University Computer and Information Sciences","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Open","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"DDoS attack analysis, Network availability, Nonparametric statistical analysis, Packet length distribution, Inter arrival time","lastPublishedDoi":"10.21203/rs.3.rs-8821541/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8821541/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eBefore noticeable symptoms like service outages or packet loss emerge, distributed denial of service (DDoS) assaults may impact network availability. The most common symptom, rather than sudden, glaring anomalies, is the slow distorting of traffic patterns at the flow level. In this study, we used a modelling framework that simulates these effects to look at actual DDoS dataset Internet traffic. Starting with a separation of attack traffic from benign traffic, we compare the distributions of fifteen flow-level features. For each feature, we monitor three different types of stress: central displacement, dispersion, and heavy upper tails. Central displacement is the movement of the distribution's center, while dispersion is the inflation of the distribution. Heavy upper tails are the amplification of the extremes. The end result of integrating these components is the Availability Stress Index (ASI). We assess the statistical significance of the differences using the Mann-Whitney rank-sum test, which corrects false discovery rate in multiple comparisons. Assaults put the most strain on packet-length and backward inter-arrival time-related properties. There seems to be a significant statistical difference between several of these variables, as their adjusted p-values are less than 10\u003csup\u003e-30\u003c/sup\u003e. Considering the cumulative effects, we can no longer pin the decline in availability on a particular factor. The combination of random timing with bursts of high activity, however, is what really stands out. It is worth mentioning that this system is independent of static thresholds and pre-trained models. Its only premise is that, during an assault, the distribution of traffic characteristics changes. Important for availability-critical network services, this enables ASI to detect, in both real-world and simulated scenarios, the traffic components linked to long-term availability stress.\u003c/p\u003e","manuscriptTitle":"Availability Stress Analysis of DDoS Traffic Affecting Cryptocurrency Infrastructure","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-02-19 12:11:39","doi":"10.21203/rs.3.rs-8821541/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-03-01T19:10:26+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-02-27T02:49:12+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-02-26T08:49:13+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"194163130523459042709008890093849009692","date":"2026-02-24T22:09:08+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"20682278290078155305899338292024590209","date":"2026-02-24T21:30:18+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-02-16T09:42:29+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"1742071913276063169216147021518268619","date":"2026-02-16T05:20:28+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"250378649596790372142590409774106970283","date":"2026-02-13T16:34:44+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"334330254060098225651902969496229965863","date":"2026-02-13T15:48:57+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-02-13T15:01:24+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-02-10T02:20:34+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-02-10T02:20:06+00:00","index":"","fulltext":""},{"type":"submitted","content":"Journal of King Saud University Computer and Information Sciences","date":"2026-02-08T12:29:43+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"journal-of-king-saud-university-computer-and-information-sciences","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [Journal of King Saud University Computer and Information Sciences](https://link.springer.com/journal/44443)","snPcode":"44443","submissionUrl":"https://submission.springernature.com/new-submission/44443/3","title":"Journal of King Saud University Computer and Information Sciences","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Open","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"c4a7715d-ea5b-4835-876c-529c8ab430b2","owner":[],"postedDate":"February 19th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-03-22T13:53:29+00:00","versionOfRecord":[],"versionCreatedAt":"2026-02-19 12:11:39","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8821541","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8821541","identity":"rs-8821541","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}