Adaptive DDoS Defense Strategies for High-Throughput Payment Processing Systems: A 2003–2025 Architecture Evolution from Mainframe to AI-Native Microservices

Distributed Denial of Service (DDoS) attacks against payment processing infrastructure increased 154% between 2022 and 2023, with application-layer volumes growing 200% in the first half of 2024. Payment systems must sustain 65,000+ transactions per second (TPS) under 50 ms authorization latency constraints while defending against attacks that have escalated from 1 Gbps floods (2003) to 398 million requests per second via HTTP/2 Rapid Reset (2023). We present the first comprehensive survey mapping DDoS defense strategies across the full 2003-2025 architectural evolution of payment processing, from mainframe-era CICS/COBOL through SOA/ESB middleware and cloud-native Kubernetes to AI-augmented defenses. Based on a systematic literature review of 92 sources, 14 industry reports, 10 patents, and 40+ historical incidents, we propose a five-era evolution model, a five-category defense taxonomy with strategy interaction matrix, and the Composite Slow-Degradation Attack (CSDA) as a theoretical worst-case adversary model. We introduce four analytical frameworks (TAADA, ACS-GUARD, BIN-WATCH, and LBMD) characterized through simulation as design proposals for empirical validation. Extended empirical evaluation includes: BIN-WATCH on realistic traffic (Zipf alpha = 0.8, entropy-aware attacker) achieving F1 = 0.90 at default threshold and F1 = 1.00 at recalibrated threshold; LBMD with directly measured inference latency showing XGBoost achieves DER = 0.960 at the 5 ms budget (P99 = 0.17 ms); and ACS-GUARD validated across a 270-combination parameter sensitivity sweep demonstrating 62.5-68.3% legitimate acceptance at alpha = 0.85-0.90 under sustained attack.