LF-Filter: Differentiated Processing for Intra-Flow Packet Delay Monitoring in High-Speed Data Streams

Monitoring inter-event delays in high-speed data streams is fundamental to anomaly detection and temporal pattern discovery. A representative instance in production infrastructures is intra-flow packet delay (IFPD), i.e., the time interval between consecutive packets of the same flow. It serves as a critical metric for detecting network anomalies such as low-rate DDoS attacks and port scans. Existing solutions suffer from high collision rates and fixed temporal granularity, leading to limited detection accuracy.