PAD: A Port-Level Adaptive and Hierarchical DDoS Detection System for High-Privacy NAT Networks

With the proliferation of devices connected to the Internet, distributed denial-of-service (DDoS) attacks have become an increasingly serious threat to network security. Although extensive research has been conducted, most existing detection methods rely heavily on extracting IP address information - an approach that becomes ineffective in high-privacy environments such as those protected by Network Address Translation (NAT), where destination IPs are often inaccessible. To address this limitation, we propose PAD, a port-level adaptive and hierarchical DDoS detection system. PAD introduces a core mechanism called adaptive risk port locking, which dynamically categorizes ports based on their susceptibility to high-rate or low-rate DDoS attacks, as well as benign usage patterns. This classification enables service-level isolation and supports a two-tiered detection strategy: lightweight, rule-based analysis for high-rate traffic and machine learning models for stealthy low-rate traffic. Evaluated on the Aitrans2024 dataset - characterized by diverse and mixed attack patterns - PAD achieved an accuracy of 99.87% in real-time detection, without relying on IP address information. While direct comparisons with conventional IP-based methods are not provided, the results demonstrate the viability of portlevel detection in high-privacy, NAT-based network environments.