A Survey on Network-Layer DDoS Resilience and Cryptographic Data Integrity Verification in Cloud Storage Infrastructures

Abstract: Cloud storage systems increasingly face two distinct but interacting classes of threat: Distributed Denial-of- Service (DDoS) attacks that degrade or remove service availability, and silent data tampering carried out by ransomware or insiders that compromises data integrity without triggering an outage. Existing literature largely treats these as separate research problems — DDoS detection and mitigation studies evaluate only availability metrics, while data-integrity studies assume an always-reachable verification channel. This survey reviews the current state of research across four areas relevant to closing that gap: network- and application-layer DDoS detection, software-defined-network-based automated mitigation, client-side encryption for zero-knowledge cloud storage, and Merkle-tree/blockchain-anchored

across detection scope, mitigation capability, and integrity guarantees. Four research gaps are identified, the most central being the absence, across all reviewed systems, of a single pipeline that simultaneously guarantees service availability and cryptographically verified data integrity. The survey concludes by outlining how a unified Defense-in-Depth architecture — combining adaptive DDoS mitigation with AES-256 client-side encryption and Merkle-tree integrity hashing — can close this gap.

Keywords: cloud security, DDoS mitigation, Merkle tree, AES-256 encryption, zero-knowledge storage, blockchain- anchored integrity, ransomware resilience, software-defined networking.