Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Holmes: An Evidence-Grounded LLM Agent for Auditable DDoS Investigation in Cloud Networks

Haodong Chen, Ziheng Zhang, Jinghui Jiang, Qiang Su, Qiao Xiang

TL;DR

Holmes reframes DDoS detection in cloud environments as an auditable investigation conducted by a virtual SRE LLM agent. It combines a hierarchical, on-demand workflow with a semantic Evidence Pack that converts binary traffic into compact, quotable anchors, and a strict quote-grounded reasoning protocol with JSON outputs. Experiments on CICDDoS2019 and scripted floods demonstrate robust, traceable attributions across attack families and reveal how audit logs expose reasoning gaps. The approach enables cost-efficient, auditable DDoS investigation in real-world cloud operations through verifiable evidence chains and structured reports.

Abstract

Cloud environments face frequent DDoS threats due to centralized resources and broad attack surfaces. Modern cloud-native DDoS attacks further evolve rapidly and often blend multi-vector strategies, creating an operational dilemma: defenders need wire-speed monitoring while also requiring explainable, auditable attribution for response. Existing rule-based and supervised-learning approaches typically output black-box scores or labels, provide limited evidence chains, and generalize poorly to unseen attack variants; meanwhile, high-quality labeled data is often difficult to obtain in cloud settings. We present Holmes (DDoS Detective), an LLM-based DDoS detection agent that reframes the model as a virtual SRE investigator rather than an end-to-end classifier. Holmes couples a funnel-like hierarchical workflow (counters/sFlow for continuous sensing and triage; PCAP evidence collection triggered only on anomaly windows) with an Evidence Pack abstraction that converts binary packets into compact, reproducible, high-signal structured evidence. On top of this evidence interface, Holmes enforces a structure-first investigation protocol and strict JSON/quotation constraints to produce machine-consumable reports with auditable evidence anchors. We evaluate Holmes on CICDDoS2019 reflection/amplification attacks and script-triggered flooding scenarios. Results show that Holmes produces attribution decisions grounded in salient evidence anchors across diverse attack families, and when errors occur, its audit logs make the failure source easy to localize, demonstrating the practicality of an LLM agent for cost-controlled and traceable DDoS investigation in cloud operations.

Holmes: An Evidence-Grounded LLM Agent for Auditable DDoS Investigation in Cloud Networks

TL;DR

Holmes reframes DDoS detection in cloud environments as an auditable investigation conducted by a virtual SRE LLM agent. It combines a hierarchical, on-demand workflow with a semantic Evidence Pack that converts binary traffic into compact, quotable anchors, and a strict quote-grounded reasoning protocol with JSON outputs. Experiments on CICDDoS2019 and scripted floods demonstrate robust, traceable attributions across attack families and reveal how audit logs expose reasoning gaps. The approach enables cost-efficient, auditable DDoS investigation in real-world cloud operations through verifiable evidence chains and structured reports.

Abstract

Cloud environments face frequent DDoS threats due to centralized resources and broad attack surfaces. Modern cloud-native DDoS attacks further evolve rapidly and often blend multi-vector strategies, creating an operational dilemma: defenders need wire-speed monitoring while also requiring explainable, auditable attribution for response. Existing rule-based and supervised-learning approaches typically output black-box scores or labels, provide limited evidence chains, and generalize poorly to unseen attack variants; meanwhile, high-quality labeled data is often difficult to obtain in cloud settings. We present Holmes (DDoS Detective), an LLM-based DDoS detection agent that reframes the model as a virtual SRE investigator rather than an end-to-end classifier. Holmes couples a funnel-like hierarchical workflow (counters/sFlow for continuous sensing and triage; PCAP evidence collection triggered only on anomaly windows) with an Evidence Pack abstraction that converts binary packets into compact, reproducible, high-signal structured evidence. On top of this evidence interface, Holmes enforces a structure-first investigation protocol and strict JSON/quotation constraints to produce machine-consumable reports with auditable evidence anchors. We evaluate Holmes on CICDDoS2019 reflection/amplification attacks and script-triggered flooding scenarios. Results show that Holmes produces attribution decisions grounded in salient evidence anchors across diverse attack families, and when errors occur, its audit logs make the failure source easy to localize, demonstrating the practicality of an LLM agent for cost-controlled and traceable DDoS investigation in cloud operations.
Paper Structure (23 sections, 2 figures, 2 tables)

This paper contains 23 sections, 2 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Cloud DDoS Detection and Mitigation Pipelines
  4. Behavior- and Statistics-based DDoS Detection
  5. Large Language Models for Network Traffic Understanding
  6. LLM-based Cybersecurity Agents
  7. Design
  8. Hierarchical Perception and On-Demand Investigation
  9. Semantic Evidence Abstraction and Evidence Pack
  10. Evidence-Grounded Reasoning with Quote and Format Constraints
  11. Structure-first multi-step investigation protocol.
  12. Prompt Contract: grounding and output specification.
  13. Format constraints and self-correction.
  14. Audit logging.
  15. Experiments
  16. ...and 8 more sections

Figures (2)

  • Figure 1: DDoS Detective Overview
  • Figure 2: Simplified prompt contract used by Holmes. It formalizes evidence grounding (Quote Rule), a structure-first investigation protocol (Route-1), and strict JSON outputs for downstream consumption.