Designing the architecture of a software system for detecting and blocking HTTP LR-DDoS attacks on the Kubernetes platform
DOI:
https://doi.org/10.34185/1562-9945-5-166-2026-24Keywords:
DDoS, low-rate DDoS attacks, LR-DDoS, software system, software engineering, microservice architecture, Kubernetes, Istio, information security, cryptographyAbstract
This paper proposes and implements a distributed architecture for protecting microservices against application-layer low-rate DDoS (LR-DDoS) attacks in a Kubernetes environment, without modifying the target applications’ code and without introducing noticeable latency to legitimate traffic. The architectural solution is based on separating the routing plane (Data Plane) and the analysis plane (Control Plane): application-layer attributes are collected by the EnvoyFilter extension after TLS decryption at the Istio ingress gateway, and network attributes are gathered using eBPF/XDP technologies, after which they are asynchronously forwarded to the Apache Kafka broker. The horizontally scalable classification module, developed in Go, and the controller based on the Kubernetes Operator pattern store DDoS attack sources in Redis with a TTL mechanism to remove stale data and update blocking rules in the AuthorizationPolicy resource. This enables three attack mitigation scenarios: full classification of unknown sessions, accelerated verification against preserved signatures, and request blocking at the gateway with O(1) complexity. Experimental studies have confirmed the system’s high performance: the latency overhead from the EnvoyFilter is only 2.933 ms, and the response time is 3.15 s for new sources, 0.8 s for known signatures, and 5.674 ms for gateway-level blocking. The classification module processes 4,000 sessions in 32.5 ms using 3.09 MB of RAM. Compared to the Coraza Web Application Firewall (WAF), the proposed system demonstrates 12.3 times lower latency (3.667 ms versus 45 ms) and significantly higher throughput (1,973 versus 473 requests/s).
References
1. Yoachimik, O., & Pacheco, J. (2026). 2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaults. The Cloudflare Blog. https://blog.cloudflare.com/ddos-threat-report-2025-q4/
2. Singh Samra, R., & Barcellos, M. (2023). DDoS2Vec: Flow-level characterisation of vol-umetric DDoS attacks at scale. Proceedings of the ACM on Networking, 1(CoNEXT3), Arti-cle 13. https://doi.org/10.1145/3629135
3. Sabri, S., Ismail, N., & Hazzim, A. (2021). Slowloris DoS attack based simulation. IOP Conference Series: Materials Science and Engineering, 1062(1), Article 012029. https://doi.org/10.1088/1757-899x/1062/1/012029
4. Damon, E., Dale, J., Laron, E., Mache, J., Land, N., & Weiss, R. (2012). Hands-on denial of service lab exercises using SlowLoris and RUDY. In The 2012 information security cur-riculum development conference (pp. 21–29). ACM Press. https://doi.org/10.1145/2390317.2390321
5. Shafieian, S., Zulkernine, M., & Haque, A. (2015). CloudZombie: Launching and detecting slow-read distributed denial of service attacks from the cloud. In 2015 IEEE international conference on computer and information technology; ubiquitous computing and communica-tions; dependable, autonomic and secure computing; pervasive intelligence and computing (pp. 1733–1740). IEEE. https://doi.org/10.1109/cit/iucc/dasc/picom.2015.261
6. Zhijun, W., Wenjing, L., Liang, L., & Meng, Y. (2020). Low-Rate DoS attacks, detection, defense, and challenges: A survey. IEEE Access, 8, 43920–43943. https://doi.org/10.1109/access.2020.2976609
7. Tripathi, N., & Hubballi, N. (2021). Application layer denial-of-service attacks and de-fense mechanisms. ACM Computing Surveys, 54(4), Article 86. https://doi.org/10.1145/3448291
8. Rios, V. D. M., Inacio, P. R. M., Magoni, D., & Freire, M. M. (2022). Detection and miti-gation of low-rate denial-of-service attacks: A survey. IEEE Access, 10, 76648–76668. https://doi.org/10.1109/access.2022.3191430
9. Velepucha, V., & Flores, P. (2023). A survey on microservices architecture: Principles, patterns and migration challenges. IEEE Access, 11, 88339–88358. https://doi.org/10.1109/access.2023.3305687
10. Vasireddy, I., Ramya, G., & Kandi, P. (2023). Kubernetes and docker load balancing: State-of-the-art techniques and challenges. International Journal of Innovative Research in Engineering and Management, 10(6), 49–54. https://doi.org/10.55524/ijirem.2023.10.6.7
11. Deressu, T. F., Beyene, A. M., & Gemechu, A. Y. (2026). A survey of application layer distributed denial of service detection: Approaches, models, and datasets. Artificial Intelligence Review, 59(6), Article 139. https://doi.org/10.1007/s10462-026-11528-3
12. Tian, Q., & Miyata, S. (2023). A DDoS attack detection method using conditional en-tropy based on SDN traffic. IoT, 4(2), 95–111. https://doi.org/10.3390/iot4020006
13. Qasim, S. S., & Nsaif, S. M. (2024). Advancements in time series-based detection sys-tems for distributed denial-of-service (DDoS) attacks: A comprehensive review. Babylonian Journal of Networking, 2024, 9–17. https://doi.org/10.58496/bjn/2024/002
14. Savchenko, V., Ilin, O., Hnidenko, N., Tkachenko, O., Laptiev, O., & Lehominova, S. (2020). Detection of slow DDoS attacks based on user’s behavior forecasting. International Journal of Emerging Trends in Engineering Research, 8(5), 2019–2025. https://doi.org/10.30534/ijeter/2020/90852020
15. Alashhab, A. A., Zahid, M. S. M., Azim, M. A., Daha, M. Y., Isyaku, B., & Ali, S. (2022). A survey of low rate DDoS detection techniques based on machine learning in soft-ware-defined networks. Symmetry, 14(8), Article 1563. https://doi.org/10.3390/sym14081563
16. Ilango, H. S., Ma, M., & Su, R. (2022). A feedforward–convolutional neural network to detect low-rate DoS in IoT. Engineering Applications of Artificial Intelligence, 114, Article 105059. https://doi.org/10.1016/j.engappai.2022.105059
17. Onai, M. V., & Kravchuk, A. A. (2024). Vdoskonalennia ta analiz efektyvnosti metodiv vyiavlennia DDoS-atak na osnovi protokolu HTTP. In Prykladna matematyka ta kompiutynh PMK' 2024 (pp. 149–153). https://ela.kpi.ua/handle/123456789/71110
18. Leka, E., Lamani, L., Aliti, A., & Hoxha, E. (2024). Web application firewall for detect-ing and mitigation of based DDoS attacks using machine learning and blockchain. TEM Journal, 13(4), 2802–2811. https://doi.org/10.18421/tem134-17
19. Dawadi, B. R., Adhikari, B., & Srivastava, D. K. (2023). Deep learning technique-enabled web application firewall for the detection of web attacks. Sensors, 23(4), Article 2073. https://doi.org/10.3390/s23042073
20. OWASP ModSecurity Core Rule Set (CRS): Project Documentation. (2026). OWASP Foundation. https://coreruleset.org/docs/
21. Alasri, A., & Sulaiman, R. (2018). Protection of XML-based denail-of-service and HTTP flooding attacks in web services using the middleware tool. International Journal of Engi-neering and Technology, 7(4.7), 322–329. https://doi.org/10.14419/ijet.v7i4.7.20570
22. Berezhna, M. (2025). Separation of concerns: A fundamental principle in software devel-opment. DEV Community. https://dev.to/marie_berezhna/separation-of-concerns-a-fundamental-principle-in-software-development-oaj
23. Khairuddin, M. A., Mohd Isa, M. R., Mohd Shukran, M. A., Ismail, M. N., & Maskat, K. (2024). Detecting distributed denial-of-service (DDoS) attacks through the log consolidation processing (LCP) framework. International Journal on Informatics Visualization, 8(3), 1064–1073. https://doi.org/10.62527/joiv.8.3.2184
24. Kammer, A., Koppelt, C., Müller, J., Prinz, H., Schmidt, C., Steinke, M., & Wolff, E. (2024). Service mesh overview and comparison. INNOQ. https://servicemesh.es/
25. Singh, P., & Ayyasamy, S. (2023). Exploring, analyzing and tuning service mesh per-formance: A literature review. TechRxiv. https://doi.org/10.36227/techrxiv.22776119.v1
26. Priya Patharlagadda, P. (2022). Kubernetes traffic management using Istio. Journal of Media & Management, 4(1). https://doi.org/10.47363/jmm/2022(4)e101
27. Architecture overview and what is Envoy – Envoy documentation. (2026). Envoy proxy. https://www.envoyproxy.io/docs/envoy/v1.38.2/intro/what_is_envoy
28. Envoy Filter: Traffic management in Istio – Istio documentation. (2026). Istio. https://istio.io/latest/docs/reference/config/networking/envoy-filter/
29. Kubernetes documentation: Fundamental concepts. (2026). The Kubernetes Authors. https://kubernetes.io/docs/concepts/
30. Vieira, M. A. M., Castanho, M. S., Pacífico, R. D. G., Santos, E. R. S., Júnior, E. P. M. C., & Vieira, L. F. M. (2020). Fast Packet Processing with eBPF and XDP. ACM Computing Surveys, 53(1), Article 16. https://doi.org/10.1145/3371038
31. Kubernetes documentation: Operator pattern. (2025). The Kubernetes Authors. https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
32. Kubernetes controller-runtime project – Go Packages. (2026). The Go Project. https://pkg.go.dev/sigs.k8s.io/controller-runtime
33. Reitz, K. (2026). PostmanLabs/httpbin: HTTP request & response service, written in py-thon + flask. GitHub, Inc. https://github.com/postmanlabs/httpbin
34. Fortio load testing library, command line tool, advanced echo server in go. (2026). For-tio. https://fortio.org/
35. SlowHttp – Slow Read DDoS simulator written as a Python script. (2026). GitHub, Inc. https://github.com/ojardila/slowhttp
36. Coraza – open source, enterprise-grade, high performance web application firewall. (2026). Coraza. https://www.coraza.io/docs/tutorials/introduction/
Downloads
Published
Issue
Section
License
Copyright (c) 2026 System technologies
This work is licensed under a Creative Commons Attribution 4.0 International License.
