HTTP2DoS

Official implementation of the paper:

HTTP2DoS: Detecting Low-and-Slow HTTP/2 DoS Attacks with Complex Transfer-Entropy Graph-Temporal Learning

---

Repository Structure

HTTP2DoS/
├── Attack-Simulator/        # Docker-based HTTP/2 attack lab
├── HTTP2DoS/                # Detection algorithm (core)
│   ├── src/
│   │   ├── preprocess/      # PCAP parsing, feature encoding, dataset building
│   │   ├── te/              # Transfer Entropy computation (CPU & GPU)
│   │   ├── cgcn.py          # Complex Graph Convolutional Network
│   │   ├── gkd_kernel.py    # Graph Knowledge Distillation (kernel teacher)
│   │   ├── gkd_student.py   # GKD student model
│   │   ├── trainer.py       # Training and evaluation loop
│   │   ├── detect_anomaly.py
│   │   └── ...
│   ├── main.py              # Training entry point
│   ├── main_preprocess.py   # Single-dataset preprocessing
│   ├── main_preprocess_multipart.py  # Multi-subset preprocessing
│   ├── inference.py         # MIL inference entry point
│   └── requirements.txt
└── Virtual-Bank/            # HTTP/2 testbed for dataset collection

Citation

If you use this code for your research, please cite our paper:

@article{aharon2026http2dos,
  title={HTTP2DoS: Detecting low-and-slow HTTP/2 DoS attacks with complex transfer-entropy graph-temporal learning},
  author={Aharon, Udi and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
  journal={Computers \& Security},
  pages={105198},
  year={2026},
  publisher={Elsevier}
}