Cross-Protocol DDoS Detection via HTTP/2 Stream Reconstruction: A Multiplexing-Aware Traffic Transformation Approach
Year: 2026
Type: article
Abstract: With the increasing complexity of online applications, HTTP/2 has significantly improved transmission efficiency through key enhancements in network architecture. However, the structural changes introduced by HTTP/2 make it difficult to directly adapt existing DDoS attack detection algorithms, which are primarily designed for HTTP/1, to HTTP/2 environments. To address this issue, this paper proposes an HTTP/2-oriented protocol conversion algorithm that reconstructs HTTP/2 traffic into a data representation conforming to the HTTP/1 request–response structure by leveraging the stream mechanism of HTTP/2. Specifically, the proposed method uses the Stream ID as the fundamental partitioning unit and performs ordered association and reassembly of HEADERS and DATA frames within the same stream to restore complete request–response interactions. This design preserves request independence while retaining the behavioral characteristics and semantic integrity of the original traffic to the greatest extent possible, thereby providing compatible input data for existing HTTP/1-based detection models. Furthermore, to ensure the practical deployability of the proposed method, an engineering deployment architecture compatible with the protocol conversion algorithm is designed and implemented. The architecture adopts a bypass-based traffic mirroring mechanism combined with a real-time stream reassembly module, enabling low-latency and high-throughput online traffic conversion without interfering with the normal operation of existing business systems. To evaluate the effectiveness and feasibility of the proposed method, an experimental environment was constructed, and multiple experiments were conducted using existing HTTP/1-based DDoS detection models on the converted HTTP/2 traffic data. Experimental results demonstrate that the converted traffic data maintain a high degree of consistency with existing public datasets in terms of core statistical features and data structure characteristics. Moreover, effective detection of HTTP/2 DDoS attacks can be achieved without requiring any structural modifications to the original HTTP/1 detection models, while maintaining detection performance comparable to that obtained on the original HTTP/1 datasets. The proposed method and its corresponding deployment architecture provide a complete and practically deployable solution for the smooth migration of existing HTTP/1-based threat detection systems to HTTP/2 environments, while also offering new insights and engineering references for future research on cross-protocol network security detection.
Source: IEEE Access
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,075
OpenAlex ID: W7207555857