Tanchun: Robust Flow-Based HTTP(S) DDoS Detection via Behavioral Attribute Guidance

HTTP(S) DDoS attacks have surged in frequency and scale, posing a significant threat to network security. Flow-based detection is a promising solution for large-scale HTTP(S) DDoS detection due to its decryption-free operation and scalability. However, the coarse-grained numerical statistics in flow data limit accurate attack detection and lack robustness when benign and attack traffic patterns drift over time. In this paper, we present Tanchun, a drift-aware flow-based HTTP(S) DDoS detection system that relies solely on decryption-free flow data. Specifically, Tanchun groups flows by IP-pair and aggregates them over consecutive time slots into behavior sequences, capturing temporal access patterns to compensate for the limited information in individual flows. It further abstracts these sequences into human-understandable behavioral attributes that capture stable behavioral semantics. Tanchun then aligns behavior sequences with their corresponding behavioral attributes to guide representation learning, enabling robust detection under traffic drift. We evaluate Tanchun across diverse HTTP(S) DDoS scenarios. Tanchun achieves the best overall performance, with an average F1-score of 0.988, and outperforms the second-best method by 5.3\% and 9.6\% under benign-traffic and attack-traffic drift, respectively. Experiments on real-world traffic traces further demonstrate its practical effectiveness.