Deterministic Preprocessing Techniques in Deep Packet Inspection-Based Anomaly Detection: A Systematic Thematic Analysis

Abstract

Classical approaches to anomaly detection that utilize traditional Deep Packet Inspection (DPI) are inherently based on stringent preprocessing activities to ensure detection precision, scalable implementation, as well as resistance to advanced network threats. As this preprocessing layer contains heterogeneous, implementation-specific decisions, which are often not comparable in terms of their outcome counts alone, a more traditional systematic review, where such decisions are usually intended to contribute to aggregating headline results and weighing the quality of the study results in a fixed, reproducible fashion, would give only a partial picture of the evidence base. Our goal, however, is not merely to count how often packet reassembly or flow aggregation succeeds, but to trace the recurring patterns and new directions in deterministic pre-processing for traditional DPI-based anomaly detection. The paper is a synthesis and thematically analyzes 38 peer-reviewed articles published in 2020-2025, which involve deterministic preprocessing techniques incorporated into traditional DPI pipelines. Based on the CFMO (Context–Feature–Mechanism–Outcome) theoretical model, the review establishes eight fundamental preprocessing themes, including Packet Capture and Parsing, Stream Reassembly, Payload Fragment Handling, Packet Conditioning, Traffic Sampling and Aggregation, Quality of Service (QoS) Tagging, Session Reconstruction and Time-Series Alignment, and Flow Enrichment. Analysis reveals that Packet Capture and Parsing remains the predominant technique, present in 87 percent of the examined literature, with consistent usage over the period. In contrast, higher-level mechanisms like flow enrichment and QoS-based tagging have seen limited implementation. Notably, the focus has largely been placed on Session Reconstruction and Time-Series Alignment because it enables an organization to organize data to be used in a behavior-aware or flow-based detector. Stream reassembly and Fragment Handling are still essential for protocol integrity, but have visibly declined in use over the last few years. The paper uses thematic diagrams and trend charts to depict the hierarchical and interrelated nature of modern preprocessing mechanisms. This review confirms that DPI preprocessing is a dynamic sequence of intelligent modules, ranging from accurate packet acquisition to flow reconstruction with semantically rich contents, designed to handle such issues as network fragmentation, encryption, evasion, and high data rates. Moreover, it determines the main gaps in research, such as the lack of comparative evaluation of the sampling methods and underutilization of DSCP/ToS fields in adaptive policy routing. The study consolidates existing practices and new directions in research and offers practical guidance to scholars and developers who want to improve DPI capabilities through next-generation preprocessing architectures