---
title: Formal Conditional Tree Taxonomy
url: https://www.emergentmind.com/topics/formal-conditional-tree-taxonomy
type: topic
---

# Formal Conditional Tree Taxonomy

Searching arXiv for the primary paper and closely related tree-formalization references.
Formal conditional tree taxonomy is a condition-based classification function over denial attacks, implemented as a rooted decision tree whose internal nodes are six observable binary conditions \(C_0,\dots,C_5\) and whose leaves are named attack classes: DoS, DDoS, LDoS, LDDoS, EDoS, DoW, and DDoW. In the unified framework introduced in "Rethinking Denial-of-Service: A Conditional Taxonomy Unifying Availability and Sustainability Threats" [2508.19283], the taxonomy is paired with a hierarchical lattice structure based on order theory and a conceptual Venn diagram. Its purpose is to classify both legacy and cloud-era denial attacks using a shared vocabulary grounded in source distribution, traffic volume, infrastructure targeting, and financial exploitation.

## 1. Formal object and decision-theoretic structure

At its core, the taxonomy is a function
\[
f : \{0,1\}^6 \to \mathcal{A}
\]
where \(\{0,1\}^6\) records whether each observable condition \(C_i\) is satisfied and
\[
\mathcal{A} = \{\text{DoS}, \text{DDoS}, \text{LDoS}, \text{LDDoS}, \text{EDoS}, \text{DoW}, \text{DDoW}\}.
\]
The mapping is not defined for all \(2^6\) condition combinations. It is defined exactly along the paths of a rooted directed tree
\[
T = (V,E,r),
\]
with root \(r = C_0\), condition nodes \(C_0,\dots,C_5\), and leaf nodes representing attack classes. Each root-to-leaf path specifies the conditions that must hold for classification into a particular attack class [2508.19283].

“Conditional” means that each \(C_i\) is a predicate on observable attack features:
\[
C_i : \mathcal{X} \to \{0,1\},
\]
where \(\mathcal{X}\) is the space of observable attack features such as traffic traces, source distribution, infrastructure type, and billing behaviour. For an attack instance \(x\),
\[
C_i(x) = 1 \iff \text{attack } x \text{ satisfies condition } C_i.
\]
“Tree” means that these predicates are evaluated hierarchically as a decision procedure: internal nodes are conditions, branches encode conditional evaluation steps, and leaves are attack labels. If a path to leaf \(a\) passes through conditions \(C_{i_1},\dots,C_{i_k}\), then
\[
f(x)=a
\]
if and only if those path conditions are satisfied and the alternative sibling conditions on that path are not satisfied [2508.19283].

Related research has formalized comparable hierarchical rule structures in other domains. Legal reasoning has been represented as binary trees whose node positions make rule priority explicit [2212.08335]. Ontological work on trees has defined rooted directed branching trees in terms of a unique root, exactly one parent for every non-root node, and reachability from the root [1710.05096]. This suggests that the denial-attack taxonomy belongs to a broader family of explicitly structured conditional formalisms.

## 2. Observable conditions \(C_0\)–\(C_5\)

The taxonomy is built from six operationally observable conditions. Let
\[
\mathbf{C}(x) = (C_0(x),C_1(x),\dots,C_5(x)) \in \{0,1\}^6.
\]

| Condition | Text definition | Operational role |
|---|---|---|
| \(C_0\) | “Malicious requests, in any capacity, are sent to a target.” | Baseline existence of a denial attack |
| \(C_1\) | malicious requests originate from a single source | Non-distributed attack branch |
| \(C_2\) | “Requests originate from multiple sources.” | Distributed attack branch |
| \(C_3\) | “Less than 1,000 packets or 10–20% of normal traffic.” | Low-rate / stealth vector |
| \(C_4\) | “Targets scalable cloud infrastructure resources.” | Cloud-economic targeting |
| \(C_5\) | “Targets serverless infrastructure.” | FaaS-specific targeting |

The root condition is
\[
C_0(x)=1 \iff \exists \text{ traffic } t \text{ in } x \text{ such that } t \text{ is malicious and directed at a target}.
\]
No classification is possible unless \(C_0=1\). Every attack class in the taxonomy therefore inherits \(C_0=1\).

Source distribution is partitioned by \(C_1\) and \(C_2\). For attack traffic \(T_{\text{mal}(x)}\) and source set \(S_{\text{mal}(x)}\),
\[
C_1(x)=1 \iff |S_{\text{mal}(x)}|=1,
\qquad
C_2(x)=1 \iff |S_{\text{mal}(x)}|>1.
\]
These conditions are mutually exclusive for classification purposes. \(C_1\) captures single-source attacks such as classic DoS, LDoS, and single-source DoW, while \(C_2\) captures distributed attacks such as DDoS, LDDoS, and DDoW.

The stealth condition \(C_3\) is defined using the packet-rate threshold or traffic-share threshold:
\[
C_3(x)=1 \iff \lambda_{\text{attack}(x)} < 1000 \;\;\lor\;\; \lambda_{\text{attack}(x)} \le 0.2 \cdot \lambda_{\text{baseline}(x)}.
\]
This identifies low-and-slow attacks designed to evade volumetric thresholds while still degrading performance.

Infrastructure targeting is split between scalable cloud resources and serverless resources:
\[
C_4(x)=1 \iff \text{the primary target of } x \text{ is an elastic, auto-scaling cloud infrastructure},
\]
\[
C_5(x)=1 \iff \text{the primary target of } x \text{ is serverless / Function-as-a-Service infrastructure}.
\]
In the taxonomy, \(C_5\) is nested under \(C_4\), reflecting that serverless is treated as a subset of scalable cloud infrastructure [2508.19283].

## 3. Rooted classification tree and canonical attack vectors

Classification begins at \(C_0\). If \(C_0(x)=0\), the instance is not a denial attack in this taxonomy. If \(C_0(x)=1\), evaluation proceeds first by source distribution: the single-source branch uses \(C_1\), the multi-source branch uses \(C_2\). Additional conditions \(C_3\), \(C_4\), and \(C_5\) then refine the class label. On the single-source side, absence of low-rate and cloud-targeting conditions yields DoS; \(C_3=1\) yields LDoS; \(C_4=1\) and \(C_5=1\) yield DoW. On the multi-source side, \(C_2\) alone yields DDoS; \(C_3=1\) yields LDDoS; \(C_4=1\) yields EDoS; and \(C_4=1\) together with \(C_5=1\) yields DDoW [2508.19283].

Table 2 of the source paper gives canonical condition vectors for the named attack classes:

| Attack class | Canonical vector \(\mathbf{C}^a\) | Tree path |
|---|---|---|
| DoS | \((1,1,0,0,0,0)\) | \(C_0 \to C_1 \to \text{DoS}\) |
| DDoS | \((1,0,1,0,0,0)\) | \(C_0 \to C_2 \to \text{DDoS}\) |
| LDoS | \((1,1,0,1,0,0)\) | \(C_0 \to C_1 \to C_3 \to \text{LDoS}\) |
| LDDoS | \((1,0,1,1,0,0)\) | \(C_0 \to C_2 \to C_3 \to \text{LDDoS}\) |
| EDoS | \((1,0,0,0,1,0)\) | typical tree illustration via \(C_2 \to C_4\) |
| DoW | \((1,1,0,0,1,1)\) | \(C_0 \to C_1 \to C_4 \to C_5 \to \text{DoW}\) |
| DDoW | \((1,0,1,0,1,1)\) | \(C_0 \to C_2 \to C_4 \to \text{EDoS} \to C_5 \to \text{DDoW}\) |

The explicit mapping is therefore
\[
f(\mathbf{C}(x))=
\begin{cases}
\text{DoS} & \text{if } \mathbf{C}(x)=\mathbf{C}^{\text{DoS}}\\
\text{DDoS} & \text{if } \mathbf{C}(x)=\mathbf{C}^{\text{DDoS}}\\
\text{LDoS} & \text{if } \mathbf{C}(x)=\mathbf{C}^{\text{LDoS}}\\
\text{LDDoS} & \text{if } \mathbf{C}(x)=\mathbf{C}^{\text{LDDoS}}\\
\text{EDoS} & \text{if } \mathbf{C}(x)=\mathbf{C}^{\text{EDoS}}\\
\text{DoW} & \text{if } \mathbf{C}(x)=\mathbf{C}^{\text{DoW}}\\
\text{DDoW} & \text{if } \mathbf{C}(x)=\mathbf{C}^{\text{DDoW}}\\
\text{undefined} & \text{otherwise (taxonomy extension required).}
\end{cases}
\]

Two clarifications are central. First, the taxonomy is not a total classifier over all binary condition tuples; undefined combinations are explicitly reserved for extension. Second, EDoS is treated in two slightly different ways in the presentation: the canonical vector does not require \(C_2=1\), while the tree figure illustrates a typical distributed EDoS through the multi-source branch. Formally, the paper states that EDoS is defined by \(C_4=1\), and the distributed rendering is a typical rather than mandatory realization [2508.19283].

## 4. Lattice structure and overlap between availability and sustainability

The taxonomy is accompanied by a partial order on attack classes. If
\[
S(a)=\{i \mid C_i^a = 1\},
\]
then
\[
a \preceq b \iff S(a) \subseteq S(b).
\]
This yields a poset \((\mathcal{A},\preceq)\) in which higher nodes satisfy more conditions and therefore represent more conditionally rich attack types. The accompanying diagram behaves like a lattice fragment rather than a full algebraic lattice over all \(2^6\) combinations. Edges correspond to adding conditions along escalation paths, such as DoS \(\rightarrow\) LDoS via \(+C_3\), or EDoS \(\rightarrow\) DDoW via \(+C_2\) and \(+C_5\) [2508.19283].

The paper’s Venn diagram separates availability-based denial attacks from sustainability-based denial attacks while allowing overlap. In condition terms,
\[
\mathcal{A}_{\text{avail}}
=
\{a\in\mathcal{A}\mid C_4(a)=0 \land C_5(a)=0\}
=
\{\text{DoS},\text{DDoS},\text{LDoS},\text{LDDoS}\},
\]
whereas
\[
\mathcal{A}_{\text{sust}}
=
\{a\in\mathcal{A}\mid C_4(a)=1 \lor C_5(a)=1\}
=
\{\text{EDoS},\text{DoW},\text{DDoW}\}.
\]

The overlap is conceptually important. EDoS may degrade performance while also attacking financial sustainability. The same condition system therefore supports both traditional availability reasoning and cloud-economic reasoning. A common misconception is to treat sustainability attacks as merely cloud variants of classical DDoS. The formalism instead treats \(C_4\) and \(C_5\) as distinct observable conditions that reorient classification toward billing, autoscaling, and per-invocation cost mechanisms [2508.19283].

## 5. Attack families and representative classifications

Availability-focused classes are defined without \(C_4\) or \(C_5\). DoS corresponds to \(C_0\) and \(C_1\): a single-source, high-rate availability attack. DDoS corresponds to \(C_0\) and \(C_2\): a multi-source high-rate availability attack. LDoS and LDDoS add the stealth condition \(C_3\), yielding single-source and multi-source low-rate variants respectively. The paper’s examples are a TCP SYN Flood case study for DoS, the Mirai botnet against Dyn DNS for DDoS, Slowloris HTTP slow attack for LDoS, and multiple coordinated nodes sending low-volume, timing-based traffic for LDDoS [2508.19283].

Sustainability-focused classes are defined by cloud and serverless targeting. EDoS is a cloud-economic attack characterized by \(C_4\), not necessarily serverless or distributed. DoW is \((C_0,C_1,C_4,C_5)\): single-source economic exhaustion of serverless billing. DDoW is \((C_0,C_2,C_4,C_5)\): distributed, serverless, economic denial of wallet. The paper’s examples include a single attacker hammering a serverless endpoint to exhaust billing without saturating resources, and distributed edge devices generating low-rate traffic that invokes FaaS functions and causes large cumulative costs. In these cases availability may be affected, but the primary goal is financial sustainability [2508.19283].

This dual family structure enables attacker intent classification. The presence of \(C_4\) and \(C_5\) suggests economic intent; \(C_3\) suggests stealth; \(C_2\) suggests distribution or resilience. A plausible implication is that the same operational observations can support both attack naming and intent analysis without requiring separate taxonomies.

## 6. Threat modeling, mitigation, and extensibility

The taxonomy is designed as both a theoretical model and an operational lens. In threat modeling, defenders can reason in terms of conditions rather than ad hoc attack names. Exposure to \(C_3\) indicates susceptibility to LDoS and LDDoS variants; exposure to \(C_5\) indicates susceptibility to DoW and DDoW even at low traffic volumes. In mitigation design, conditions map naturally to controls: \(C_1/C_2\) to anti-botnet measures and source-diversity monitoring, \(C_3\) to behavioural anomaly detection and connection-level resource policing, \(C_4\) to billing and scaling safeguards such as rate limits and budget alerts, and \(C_5\) to per-function quotas, invocation throttling, and cost caps [2508.19283].

The framework is explicitly extensible. The paper states that the current taxonomy uses binary conditions and is static and expert-defined. It proposes fuzzy or spectrum-based conditions, such as replacing
\[
C_3(x)\in\{0,1\}
\quad\text{with}\quad
C_3(x)\in[0,1],
\]
and extending the condition set
\[
\{C_0,\dots,C_5\} \to \{C_0,\dots,C_5,C_6,C_7,C_8,\dots\}
\]
to capture intent, persistence, and recovery time. It also proposes socio-technical and behavioural dimensions, including human factors, social engineering, insider threat, time-of-day, burstiness, and campaign coordination, provided that they can be mapped to observable features and integrated without breaking the condition-set inclusion hierarchy [2508.19283].

Operational integration is likewise explicit. The paper suggests mapping \(C_0\)–\(C_5\) to billing alerts, cloud-native observability and telemetry, and automated classifiers that infer condition vectors \(\mathbf{C}(x)\) in real time. This would turn the formal conditional tree taxonomy into a practical classification engine. More broadly, the framework’s combination of rooted decision tree, lattice fragment, and Venn overlap is intended to supply a shared vocabulary for interpreting evolving denial attacks in cloud-native and serverless environments, where sustainability-focused attacks are increasingly impactful yet under-recognised [2508.19283].

Source: https://www.emergentmind.com/topics/formal-conditional-tree-taxonomy