A Deterministic, Rule-Based Framework for Detecting Anomalous IP Packet Fragmentation

Anomalous IP packet fragmentation, whether caused by evasion attacks, misconfigurations, or network policy interference, presents a measurable threat to network integrity and intrusion detection systems. This paper introduces a lightweight, rule-based framework for detecting and classifying fragmented IP traffic. Unlike complex machine learning models that operate as “black boxes,” our model leverages the deterministic semantics of RFC 791 to inspect structural packet characteristics—such as offset alignment, Time-to-Live (TTL) consistency, and payload regularity—and classifies traffic into three transparent categories: normal (NONE), misconfigured (MISCONFIG), and adversarial (ATTACK). We generate an open-source and synthetic dataset of 10,000 packets, meticulously engineered to simulate a wide spectrum of benign and malicious fragmentation scenarios. Evaluation demonstrates high accuracy (99.23% overall) on this controlled dataset. Crucially, validation on the CIC-IDS-2017 real-world dataset confirms the model’s practical utility, showing a low false-positive rate (0.8%) on normal traffic and a significant increase in detectable anomalies during attack periods. This work provides a reproducible, interpretable, and efficient tool for forensic analysis and intrusion detection, enabling the precise diagnostics of packet-level fragmentation anomalies in operational networks.