CDN Traffic Anomaly Detection with Machine Learning: Pattern Recognition at Edge

Modern CDNs process billions of requests per hour across hundreds of points of presence (PoPs). In this distributed environment, traffic anomalies — from stealthy Layer 7 DDoS and origin scrapers to cache poisoning and routing leaks — often manifest as subtle, localized deviations long before they trigger global alerts. Machine learning (ML) at the edge shifts detection from reactive thresholds to proactive pattern recognition, scoring every request window in milliseconds.

This guide breaks down how ML-based anomaly detection works for CDN traffic, which models perform best at the edge, and how to architect a production pipeline that balances accuracy, latency, and cost.

Why Static Thresholds Fail at the Edge

Traditional CDN monitoring relies on fixed rules: alert if 5xx > 2%, if requests per second (RPS) exceeds 10k, or if bandwidth deviates by 30%. These rules collapse under real-world edge dynamics for three reasons:

• Seasonality and locality: A 300% RPS surge at 8 PM in a US-East PoP during a live event is normal; the same surge at 3 AM in a low-traffic PoP is an attack. Global thresholds cannot capture per-PoP diurnal and weekly patterns.
• Multidimensional anomalies: Sophisticated bots distribute requests to stay under RPS limits while skewing other dimensions — cache miss ratio, header entropy, TLS fingerprint diversity, or origin latency. Single-metric rules miss them entirely.
• Alert fatigue: Static thresholds generate thousands of false positives during flash crowds, product launches, or image optimization rollouts that change object sizes. Operators learn to ignore alerts, which is when real incidents slip through.

ML solves this by learning joint distributions. Instead of asking “is RPS high?”, the model asks “is this combination of RPS, cache status, geography, ASN, and user-agent distribution probable given this PoP’s history at this time?” For a deeper view of how DNS and routing context feed into these features, see our CDN DNS resolution explained guide.

Core ML Approaches for CDN Traffic

There is no single best model. The choice depends on labeling availability, latency budget, and anomaly type.

1. Unsupervised: Isolation Forest and Autoencoders

Most CDN anomalies are unlabeled. Unsupervised models excel here. Isolation Forest isolates outliers by randomly partitioning feature space — anomalies require fewer splits to isolate. It is fast, interpretable, and works well on tabular edge telemetry with 20-50 features.

Autoencoders (especially LSTM or Temporal Convolutional variants) learn to reconstruct normal time-series windows. High reconstruction error signals an anomaly. They capture temporal dependencies like gradual cache efficiency degradation or slow-rate application-layer attacks that Isolation Forests miss.

2. Semi-Supervised and Supervised

When you have labeled incidents from your CDN security and SOC workflows, semi-supervised models like One-Class SVM or deep SVDD refine boundaries. For known attack classes (e.g., HTTP flood vs. credential stuffing), gradient boosted trees (XGBoost, LightGBM) trained on labeled bot vs. human traffic achieve high precision when combined with bot management signals.

3. Streaming and Online Learning

CDN traffic drifts constantly. Models trained weekly become stale. Streaming algorithms — Hoeffding Trees, streaming k-means, and online autoencoders — update incrementally per window without full retraining. This is critical for edge deployment where PoP traffic profiles shift after new CDN fundamentals like cache key changes.

Feature Engineering from Edge Telemetry

Model quality is 80% features. Raw logs are noisy; engineered features expose the signal. Build features over sliding windows (typically 30s, 5m, and 60m) per PoP, per service, and per origin:

• Volumetric: RPS, bytes per second, unique IPs, unique ASNs, requests per IP entropy
• Performance: Cache hit ratio (CHR), origin latency p50/p95/p99, TLS handshake time, Time to First Byte
• Behavioral: User-Agent cardinality, header order entropy, HTTP method distribution, path depth variance, query string length distribution
• Network: TCP retransmit rate, JA3/JA4 fingerprint diversity, HTTP/2 vs HTTP/1.1 ratio, bot score distribution
• Temporal: Hour-of-day, day-of-week, time-since-last-deployment, seasonality residual from STL decomposition

Normalize per-PoP using rolling z-scores or robust scalers. For example, instead of absolute CHR, use chr_z = (chr - rolling_median_7d) / rolling_mad. This isolates true anomalies from expected regional variance. Correlate with origin signals to avoid flagging legitimate origin failover as an attack.

Architecture: Real-Time Inference at the Edge

The pattern that scales is hybrid: heavy training centrally, light inference at edge. Telemetry streams from each PoP into a streaming aggregator (Flink, Kafka Streams) that computes windowed features. A central training job retrains daily and validates drift via PSI (Population Stability Index). The resulting model — quantized to ONNX or TensorFlow Lite — is distributed to all PoPs via the CDN control plane. At request time, an edge worker scores the current window and emits an anomaly score.

This pairs naturally with edge computing runtimes. Scoring happens before the request hits cache or origin, allowing instant actions: inject a challenge, apply rate limiting, or route to a scrubbing tier. For volumetric attacks, tie the score directly to DDoS protection automation.

Model Comparison for Edge Deployment

In practice, leading teams ensemble: Isolation Forest for fast broad coverage plus an autoencoder for temporal validation. Only windows flagged by both escalate to blocking.

Implementation Example: From Logs to Alert

Below is a simplified Python pipeline for offline training and a pseudo edge worker for inference.

# offline_training.py — runs centrally on 5m windowed features
import pandas as pd
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import RobustScaler

# 1. Load windowed edge telemetry (per PoP, per 5m)
df = pd.read_parquet("s3://cdn-telemetry/windowed_5m.parquet")
features = ["rps_z", "chr_z", "p95_origin_z", "ua_entropy",
            "asn_entropy", "ja3_diversity", "miss_ratio", "bot_score_mean"]

X = RobustScaler().fit_transform(df[features])

# 2. Train — contamination tuned via historical incident rate (~0.5%)
model = IsolationForest(
    n_estimators=200,
    contamination=0.005,
    max_samples=0.8,
    random_state=42
)
model.fit(X)

# 3. Export quantized model for edge
import skl2onnx
onnx_model = skl2onnx.convert_sklearn(model, initial_types=[('input', ('float', [None, len(features)]))])
with open("iforest_edge.onnx", "wb") as f:
    f.write(onnx_model.SerializeToString())

// edge-worker.js — runs at PoP, scores every 30s window
import { inference } from "./onnx-wasm-runtime";

export async function handleWindow(windowFeatures) {
  const score = await inference.run(windowFeatures); // 0 = normal, 1 = anomaly
  const anomalyScore = Math.round((0.5 - score) * 200); // scale to 0-100

  if (anomalyScore > 85) {
    emitMetric("edge.anomaly.score", anomalyScore, { pop: windowFeatures.pop });
    return { action: "challenge", reason: "ml_anomaly_high" };
  }
  if (anomalyScore > 65) {
    return { action: "log_enhanced" };
  }
  return { action: "allow" };
}

Key operational detail: never auto-block on ML score alone in the first 2-4 weeks. Start in shadow mode (log only), measure precision against operator labels, then graduate to challenge and rate-limit actions.

Operationalizing: Reducing False Positives

Accuracy in a notebook means little if the SOC drowns in alerts. Three practices cut false positives dramatically:

1. Contextual suppression: Join anomaly scores with deployment events, campaign IDs, and origin health. If CHR drops but origin latency is stable and a purge just occurred, suppress.
2. Hierarchical alerting: Score per-PoP, but alert globally only when 3+ PoPs or a PoP + origin signal co-anomalize within 10 minutes. This filters local noise.
3. Human-in-the-loop labeling: Every alert should have one-click “True anomaly / Expected spike / False positive” feedback. Feed this into a label store and retrain weekly. Teams that do this see false positive rates drop from ~25% to <5% within two months.

Monitor model health itself: track feature drift (PSI > 0.2 triggers retrain), inference latency p99, and score distribution per PoP. A sudden shift in score distribution often indicates a feature pipeline bug, not an attack.

ML-based anomaly detection does not replace your existing rules — it augments them. Rules catch the known; ML catches the unknown. When combined, you get defense in depth: thresholds for volumetric floods, ML for the low-and-slow exfiltration or cache-bypass that rules will never see.

Start small: pick one high-value service, instrument 5-minute windowed features for a single PoP region, train an Isolation Forest, and run in shadow mode. The patterns you learn there will generalize faster than any global threshold ever could.