VeloGuard: Real-time SYN-flood detection with a 2.5 MB attention-BiLSTM, and where it breaks under unseen attacks and networks

SYN floods exhaust a server’s connection table with half-open handshakes; aimed at an API gateway, one saturated host silences every service behind it. We present VeloGuard, a compact (2.53 MB) bidirectional LSTM with Bahdanau attention that classifies windows of ten flows, and evaluate it with an interleaved block split, scalers and column filters fitted on training data only, and checkpoint selection that never sees validation or test labels. Twelve methods are tuned and trained the same way, with five seeds at each of three split offsets. On a test set with 15% attack windows VeloGuard reaches an F1 of 0.947 and an AUC of 0.975. Four classical methods score about 0.02 higher on F1, and most AUC gaps to the strongest methods lie inside the bootstrap interval. The testbed is easy (ports-only AUC 0.93). On one CPU thread its 99th-percentile latency is about 2 ms. Three results are less favourable. With one attack profile held out, VeloGuard ranks an unseen low-rate flood well (AUC 0.970) but inverts on an unseen high-rate flood (0.254), where the tree-based methods stay above 0.97, and it detects almost none of the randomised-source flood (recall 2.6%). Applied unchanged to CIC-IDS2017, which differs in network and attack type, VeloGuard’s AUC is 0.49 ± 0.08, and the order of the methods changes with the scaler and the training run. Labelled target windows separate the classes for every route we tried, but with the classes from different days this does not show that adaptation helps.