This presentation examines the engineering of a detection system designed to identify CDN “leeching” attacks that closely mimic legitimate user traffic. We will walk through the technical transition from a synthetic “cold start” model to a refined LSTM-Autoencoder approach that achieved high precision in experimental trials. We’ll discuss the behavioral feature vectors—such as IP diversity and ASN hopping—and the architectural decisions required to flag distributed restreaming.