Formal Conditional Tree Taxonomy

• Formal Conditional Tree Taxonomy is a decision tree model that classifies denial attacks by evaluating six binary conditions sequentially.
• It integrates source distribution, stealth, and cloud-economic factors through a hierarchical structure, lattice framework, and overlapping Venn diagram.
• The framework aids threat modeling and mitigation by mapping observable attack features to specific attack classes and guiding operational controls.

Searching arXiv for the primary paper and closely related tree-formalization references. Formal conditional tree taxonomy is a condition-based classification function over denial attacks, implemented as a rooted decision tree whose internal nodes are six observable binary conditions $C_0,\dots,C_5$ and whose leaves are named attack classes: DoS, DDoS, LDoS, LDDoS, EDoS, DoW, and DDoW. In the unified framework introduced in "Rethinking Denial-of-Service: A Conditional Taxonomy Unifying Availability and Sustainability Threats" (Dorsett et al., 24 Aug 2025), the taxonomy is paired with a hierarchical lattice structure based on order theory and a conceptual Venn diagram. Its purpose is to classify both legacy and cloud-era denial attacks using a shared vocabulary grounded in source distribution, traffic volume, infrastructure targeting, and financial exploitation.

1. Formal object and decision-theoretic structure

At its core, the taxonomy is a function

$f : \{0,1\}^6 \to \mathcal{A}$

where $\{0,1\}^6$ records whether each observable condition $C_i$ is satisfied and

$$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$

The mapping is not defined for all $2^6$ condition combinations. It is defined exactly along the paths of a rooted directed tree

$T = (V,E,r),$

with root $r = C_0$, condition nodes $C_0,\dots,C_5$, and leaf nodes representing attack classes. Each root-to-leaf path specifies the conditions that must hold for classification into a particular attack class (Dorsett et al., 24 Aug 2025).

“Conditional” means that each $C_i$ is a predicate on observable attack features: $f : \{0,1\}^6 \to \mathcal{A}$0 where $f : \{0,1\}^6 \to \mathcal{A}$1 is the space of observable attack features such as traffic traces, source distribution, infrastructure type, and billing behaviour. For an attack instance $f : \{0,1\}^6 \to \mathcal{A}$2,

$f : \{0,1\}^6 \to \mathcal{A}$3

“Tree” means that these predicates are evaluated hierarchically as a decision procedure: internal nodes are conditions, branches encode conditional evaluation steps, and leaves are attack labels. If a path to leaf $f : \{0,1\}^6 \to \mathcal{A}$4 passes through conditions $f : \{0,1\}^6 \to \mathcal{A}$5, then

$f : \{0,1\}^6 \to \mathcal{A}$6

if and only if those path conditions are satisfied and the alternative sibling conditions on that path are not satisfied (Dorsett et al., 24 Aug 2025).

Related research has formalized comparable hierarchical rule structures in other domains. Legal reasoning has been represented as binary trees whose node positions make rule priority explicit (Nguyen et al., 2022). Ontological work on trees has defined rooted directed branching trees in terms of a unique root, exactly one parent for every non-root node, and reachability from the root (Carral et al., 2017). This suggests that the denial-attack taxonomy belongs to a broader family of explicitly structured conditional formalisms.

2. Observable conditions $f : \{0,1\}^6 \to \mathcal{A}$7–$f : \{0,1\}^6 \to \mathcal{A}$8

The taxonomy is built from six operationally observable conditions. Let

$f : \{0,1\}^6 \to \mathcal{A}$9

Condition	Text definition	Operational role
$\{0,1\}^6$0	“Malicious requests, in any capacity, are sent to a target.”	Baseline existence of a denial attack
$\{0,1\}^6$1	malicious requests originate from a single source	Non-distributed attack branch
$\{0,1\}^6$2	“Requests originate from multiple sources.”	Distributed attack branch
$\{0,1\}^6$3	“Less than 1,000 packets or 10–20% of normal traffic.”	Low-rate / stealth vector
$\{0,1\}^6$4	“Targets scalable cloud infrastructure resources.”	Cloud-economic targeting
$\{0,1\}^6$5	“Targets serverless infrastructure.”	FaaS-specific targeting

The root condition is

$\{0,1\}^6$6

No classification is possible unless $\{0,1\}^6$7. Every attack class in the taxonomy therefore inherits $\{0,1\}^6$8.

Source distribution is partitioned by $\{0,1\}^6$9 and $C_i$0. For attack traffic $C_i$1 and source set $C_i$2,

$C_i$3

These conditions are mutually exclusive for classification purposes. $C_i$4 captures single-source attacks such as classic DoS, LDoS, and single-source DoW, while $C_i$5 captures distributed attacks such as DDoS, LDDoS, and DDoW.

The stealth condition $C_i$6 is defined using the packet-rate threshold or traffic-share threshold: $C_i$7 This identifies low-and-slow attacks designed to evade volumetric thresholds while still degrading performance.

Infrastructure targeting is split between scalable cloud resources and serverless resources: $C_i$8

$C_i$9

In the taxonomy, $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$0 is nested under $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$1, reflecting that serverless is treated as a subset of scalable cloud infrastructure (Dorsett et al., 24 Aug 2025).

3. Rooted classification tree and canonical attack vectors

Classification begins at $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$2. If $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$3, the instance is not a denial attack in this taxonomy. If $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$4, evaluation proceeds first by source distribution: the single-source branch uses $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$5, the multi-source branch uses $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$6. Additional conditions $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$7, $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$8, and $$\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.$$9 then refine the class label. On the single-source side, absence of low-rate and cloud-targeting conditions yields DoS; $2^6$0 yields LDoS; $2^6$1 and $2^6$2 yield DoW. On the multi-source side, $2^6$3 alone yields DDoS; $2^6$4 yields LDDoS; $2^6$5 yields EDoS; and $2^6$6 together with $2^6$7 yields DDoW (Dorsett et al., 24 Aug 2025).

Table 2 of the source paper gives canonical condition vectors for the named attack classes:

Attack class	Canonical vector $2^6$8	Tree path
DoS	$2^6$9	$T = (V,E,r),$0
DDoS	$T = (V,E,r),$1	$T = (V,E,r),$2
LDoS	$T = (V,E,r),$3	$T = (V,E,r),$4
LDDoS	$T = (V,E,r),$5	$T = (V,E,r),$6
EDoS	$T = (V,E,r),$7	typical tree illustration via $T = (V,E,r),$8
DoW	$T = (V,E,r),$9	$r = C_0$0
DDoW	$r = C_0$1	$r = C_0$2

The explicit mapping is therefore

$r = C_0$3

Two clarifications are central. First, the taxonomy is not a total classifier over all binary condition tuples; undefined combinations are explicitly reserved for extension. Second, EDoS is treated in two slightly different ways in the presentation: the canonical vector does not require $r = C_0$4, while the tree figure illustrates a typical distributed EDoS through the multi-source branch. Formally, the paper states that EDoS is defined by $r = C_0$5, and the distributed rendering is a typical rather than mandatory realization (Dorsett et al., 24 Aug 2025).

4. Lattice structure and overlap between availability and sustainability

The taxonomy is accompanied by a partial order on attack classes. If

$r = C_0$6

then

$r = C_0$7

This yields a poset $r = C_0$8 in which higher nodes satisfy more conditions and therefore represent more conditionally rich attack types. The accompanying diagram behaves like a lattice fragment rather than a full algebraic lattice over all $r = C_0$9 combinations. Edges correspond to adding conditions along escalation paths, such as DoS $C_0,\dots,C_5$0 LDoS via $C_0,\dots,C_5$1, or EDoS $C_0,\dots,C_5$2 DDoW via $C_0,\dots,C_5$3 and $C_0,\dots,C_5$4 (Dorsett et al., 24 Aug 2025).

The paper’s Venn diagram separates availability-based denial attacks from sustainability-based denial attacks while allowing overlap. In condition terms,

$C_0,\dots,C_5$5

whereas

$C_0,\dots,C_5$6

The overlap is conceptually important. EDoS may degrade performance while also attacking financial sustainability. The same condition system therefore supports both traditional availability reasoning and cloud-economic reasoning. A common misconception is to treat sustainability attacks as merely cloud variants of classical DDoS. The formalism instead treats $C_0,\dots,C_5$7 and $C_0,\dots,C_5$8 as distinct observable conditions that reorient classification toward billing, autoscaling, and per-invocation cost mechanisms (Dorsett et al., 24 Aug 2025).

5. Attack families and representative classifications

Availability-focused classes are defined without $C_0,\dots,C_5$9 or $C_i$0. DoS corresponds to $C_i$1 and $C_i$2: a single-source, high-rate availability attack. DDoS corresponds to $C_i$3 and $C_i$4: a multi-source high-rate availability attack. LDoS and LDDoS add the stealth condition $C_i$5, yielding single-source and multi-source low-rate variants respectively. The paper’s examples are a TCP SYN Flood case study for DoS, the Mirai botnet against Dyn DNS for DDoS, Slowloris HTTP slow attack for LDoS, and multiple coordinated nodes sending low-volume, timing-based traffic for LDDoS (Dorsett et al., 24 Aug 2025).

Sustainability-focused classes are defined by cloud and serverless targeting. EDoS is a cloud-economic attack characterized by $C_i$6, not necessarily serverless or distributed. DoW is $C_i$7: single-source economic exhaustion of serverless billing. DDoW is $C_i$8: distributed, serverless, economic denial of wallet. The paper’s examples include a single attacker hammering a serverless endpoint to exhaust billing without saturating resources, and distributed edge devices generating low-rate traffic that invokes FaaS functions and causes large cumulative costs. In these cases availability may be affected, but the primary goal is financial sustainability (Dorsett et al., 24 Aug 2025).

This dual family structure enables attacker intent classification. The presence of $C_i$9 and $f : \{0,1\}^6 \to \mathcal{A}$00 suggests economic intent; $f : \{0,1\}^6 \to \mathcal{A}$01 suggests stealth; $f : \{0,1\}^6 \to \mathcal{A}$02 suggests distribution or resilience. A plausible implication is that the same operational observations can support both attack naming and intent analysis without requiring separate taxonomies.

6. Threat modeling, mitigation, and extensibility

The taxonomy is designed as both a theoretical model and an operational lens. In threat modeling, defenders can reason in terms of conditions rather than ad hoc attack names. Exposure to $f : \{0,1\}^6 \to \mathcal{A}$03 indicates susceptibility to LDoS and LDDoS variants; exposure to $f : \{0,1\}^6 \to \mathcal{A}$04 indicates susceptibility to DoW and DDoW even at low traffic volumes. In mitigation design, conditions map naturally to controls: $f : \{0,1\}^6 \to \mathcal{A}$05 to anti-botnet measures and source-diversity monitoring, $f : \{0,1\}^6 \to \mathcal{A}$06 to behavioural anomaly detection and connection-level resource policing, $f : \{0,1\}^6 \to \mathcal{A}$07 to billing and scaling safeguards such as rate limits and budget alerts, and $f : \{0,1\}^6 \to \mathcal{A}$08 to per-function quotas, invocation throttling, and cost caps (Dorsett et al., 24 Aug 2025).

The framework is explicitly extensible. The paper states that the current taxonomy uses binary conditions and is static and expert-defined. It proposes fuzzy or spectrum-based conditions, such as replacing

$f : \{0,1\}^6 \to \mathcal{A}$09

and extending the condition set

$f : \{0,1\}^6 \to \mathcal{A}$10

to capture intent, persistence, and recovery time. It also proposes socio-technical and behavioural dimensions, including human factors, social engineering, insider threat, time-of-day, burstiness, and campaign coordination, provided that they can be mapped to observable features and integrated without breaking the condition-set inclusion hierarchy (Dorsett et al., 24 Aug 2025).

Operational integration is likewise explicit. The paper suggests mapping $f : \{0,1\}^6 \to \mathcal{A}$11–$f : \{0,1\}^6 \to \mathcal{A}$12 to billing alerts, cloud-native observability and telemetry, and automated classifiers that infer condition vectors $f : \{0,1\}^6 \to \mathcal{A}$13 in real time. This would turn the formal conditional tree taxonomy into a practical classification engine. More broadly, the framework’s combination of rooted decision tree, lattice fragment, and Venn overlap is intended to supply a shared vocabulary for interpreting evolving denial attacks in cloud-native and serverless environments, where sustainability-focused attacks are increasingly impactful yet under-recognised (Dorsett et al., 24 Aug 2025).