Pseudo-Attention-Based Lightweight Temporal Anomaly Detection for Resource-Constrained Network Systems

Satellite networks and space–ground integrated systems increasingly carry traffic over links that are exposed to cyberattacks. Among these threats, Distributed Denial-of-Service (DDoS) attacks are especially harmful. They saturate inter-satellite links and reduce transmission efficiency, and they can stall onboard communication services. Deep learning detectors handle such attacks well on the ground, but most depend on high-dimensional features and quadratic attention, whose compute and memory requirements exceed a satellite’s budget. We present LiteSat-Attn, a lightweight temporal anomaly detector based on a pseudo-attention mechanism. It reads only two link-observable features, packet length and inter-arrival time. Rather than computing Query-Key-Value (QKV) projections, it applies a pointwise (1×1) convolutional gating module to produce an adaptive temporal mask. The mask is trained jointly with the detection objective, so the model emphasizes anomalous time steps at negligible extra cost. On CICIDS2017 and DoHBrw2020, LiteSat-Attn reaches 99.67% and 99.62% accuracy while using 0.10M parameters, 0.40 MB of storage, and little inference compute. Its accuracy stays competitive with far heavier models while fitting the resource limits of satellite-side and other constrained deployments.