Semi-Supervised Learning for DNS DDoS Detection and Emerging Attack Discovery Using Synthetic DNS Traffic

Author

• Emmanuel Boadi, The University of Texas Rio Grande Valley

Date of Award

8-1-2026

Document Type

Thesis

Degree Name

Master of Science (MS)

Department

Applied Statistics and Data Science

First Advisor

Hansapani Rodrigo

Second Advisor

Sanjeev Kumar

Third Advisor

George P. Yanev

Abstract

Distributed Denial-of-Service (DDoS) attacks continue to evolve in scale and complexity, creating challenges for intrusion detection systems, particularly when labelled attack data are scarce and previously unseen attack behaviours emerge over time. This study addresses these challenges through two complementary contributions: improving DNS-based DDoS detection using semi-supervised learning and developing a framework for identifying potentially emerging attack behaviours. Three semi-supervised learning methods, namely Virtual Adversarial Training, FixMatch, and Suppressed Consistency Loss, were evaluated using Neural Network and TabTransformer backbones on the CIC-DNS_DrDoS2019 dataset. The models incorporated engineered DNS traffic features representing timing, traffic rate, flow, and packet characteristics, and were evaluated using classification metrics, statistical analysis, SHAP-based feature importance, and computational efficiency. Additionally, to identify potentially emerging attack behaviours, a generative discovery framework was developed by combining Rectified Flow-based synthetic DNS traffic generation, Transformer-based representation learning, novelty scoring, and Partitioning Around Medoids clustering. The framework identified 30 candidate emerging attack clusters and generated interpretable feature profiles and analyst-oriented summaries to support security investigation. The findings demonstrate that semi-supervised learning can provide accurate DNS-based DDoS detection under limited-labelled-data conditions, while generative modelling can support the identification and characterization of traffic patterns that differ from known attacks.

Comments

Copyright 2026 Emmanuel Boadi. All Rights Reserved. https://proquest.com/docview/3409129287

Recommended Citation

Boadi, E. (2026). Semi-Supervised Learning for DNS DDoS Detection and Emerging Attack Discovery Using Synthetic DNS Traffic [Master's thesis, The University of Texas Rio Grande Valley]. ScholarWorks @ UTRGV. https://scholarworks.utrgv.edu/etd/2063