## 1 Introduction  
As the 5 th Generation (5G) of mobile communication promoted telecommunication technologies across different domains and achieved initial success, the 3 rd-Generation Partnership Project (3 GPP) began investigating advanced features to pave the way for 6G [1]. One of these features is the Deterministic Network (DetNet) to cope with the issue that conventional IT infrastructure cannot efficiently handle latency-sensitive data [1, 2, 3, 4]. The DetNet transforms time-critical flows into Deterministic Flows (DetNet Flows) and enables guaranteed bandwidth, latency, and corresponding features, which are germane to transport time-sensitive data. By doing so, the DetNet can migrate time-critical applications from application-specific proprietary networks to packet technologies in the conventional IP-based infrastructure [4]. Due to the potentiality of the DetNet in 6G, numerous DetNet industrial automation use cases have been identified, including machine-to-machine communication in building automation systems and in the mining industry, and several corresponding methodologies have also been proposed [3]. However, several security issues have subsequently arisen [3], such as delay attacks, spoofing, reconnaissance, and, of course, Hybrid Distributed Denial of Service (Hybrid DDoS). In this study, we focus on the issue of Hybrid DDoS. Hybrid DDoS means high malicious traffic not only attacks the DetNet centralized controller itself but also attacks the links that DetNet flows pass through. On the one hand, Hybrid DDoS follows the conventional DDoS attacking pattern that exhausts controller resources by using a high volume of legitimate traffic, causing the controller operation to be significantly delayed or interrupted. This type of DDoS attack is also called a Server-Exhausted Attack (SEA) [5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16]. On the other hand, Hybrid DDoS also adopts a new type of DDoS attack, the Link Flooding Attack (LFA) [17; 18]. The LFA congests key links, called target links, to isolate servers in the target area where the cloud machines are located from clients. Hybrid DDoS attacks can easily sneak into a network under the monitoring of the current DDoS detection system. For example, the attacker can paralyze the DetNet by only congesting 60% capacity of the targeted links and 50% capacity of the centralized DetNet controller without being detected because both attacking behaviors may be treated as normal traffic patterns. Numerous studies have explored how to detect a single type of DDoS attack, i.e., an SEA [8; 9; 10; 11; 12; 13; 14; 15; 16] or LFA [19; 20; 21; 22; 23; 24]. However, the presence, magnitude, and synergy effect of hybrid attacks that launch an SEA and LFA at the same time have not been investigated. Hybrid attacks, on the one hand, apply the LFA to congest 60% capacity of target links, and on the other hand, allow the SEA to traverse noncongested target links to consume 40% capacity of the servers in the target area, causing a synergy effect where the service is interrupted. The synergy effect is an interaction or cooperation between the SEA and LFA, giving rise to a whole that is greater than the simple sum of its parts on the availability of the network. In this situation, the conventional LFA detector observes that 40% capacity of target links is available and may ignore the LFA event. Furthermore, the SEA detector calculates the server has 40% capacity to satisfy the request and may disregard SEA traffic. Under hybrid attacks, the reason causing the out-of-service effect is clearly not attributed to the SEA or the LFA. Therefore, current detection systems that can detect an SEA or LFA are not applicable to detect hybrid attacks and the corresponding synergy effects. A new detection approach that can detect Hybrid DDoS attacks and the corresponding synergy effects should be studied. This study, therefore, proposes a Flow Differentiation Detector (FDD) to detect Hybrid DDoS attacks in the DetNet.