Estimation is Not Enough: Carpet-Bombing Detection via Per-Packet Uniformity Testing
This study addresses the high detection latency of carpet bombing attacks and the failure of conventional methods caused by source address spoofing. To overcome these limitations, this work proposes SweepSketch, the first sketch-based real-time detection model. By anchoring at the destination end without maintaining per-source state, the architecture achieves structural immunity to source address spoofing. SweepSketch integrates T-HLL, CUSUM decision logic, and dual-EWMA gating techniques, and is deployed on a Tofino2 programmable switch to enable line-rate processing. Experimental evaluations demonstrate that SweepSketch attains an F1 score of 0.991 with a median alert delay of merely 186–627 ms, successfully identifying all victim prefixes. Overall, its comprehensive performance significantly surpasses that of existing baselines.