Neural Network Method for Detecting Low-Intensity DDoS Attacks with Stochastic Fragmentation and Its Adaptation to Law Enforcement Activities in the Cyber Protection of Critical Infrastructure Facilities

This article develops a method for the early detection of low-intensity DDoS attacks based on a three-factor vector metric and implements an applied hybrid neural network traffic analysis system that combines preprocessing stages, competitive pretraining (SOM), a radial basis layer, and an associative Grossberg output, followed by gradient optimisation. The initial tools used are statistical online estimates (moving or EWMA estimates), CUSUM-like statistics for identifying small stable shifts, and deterministic signature filters. An algorithm has been developed that aggregates the components of fragmentation, reception intensity, and service availability into a single index. Key features include the physically interpretable features, a hybrid neural network architecture with associative stability and low computational complexity, and built-in mechanisms for adaptive threshold calibration and online training. An experimental evaluation of the developed method using real telemetry data demonstrated high recognition performance of the proposed approach (accuracy is 0.945, AUC is 0.965, F1 is 0.945, localisation accuracy is 0.895, with an average detection latency of 55 ms), with these results outperforming the compared CNN-LSTM and Transformer solutions. The scientific contribution of this study lies in the development of a robust, computationally efficient, and application-oriented solution for detecting low-intensity attacks with the ability to integrate into edge and SOC systems. Practical recommendations for reducing false positives and further improvements through low-training methods and hardware acceleration are also proposed.