My testbed needs a DDoS detection script or program/software. After detection I will use my solution to do measurements after.
Do I need to count the number of packets per second and use a threshold mechanism for detection? Or should I have to think about extraction of some specific parameter which would point to a DDoS attack?
I have seen in the market where machine learning algorithms are used for anomaly detection. In my scenarion I will be generating UDP, TCP, HTTP-GET floods. For the what is the right way to do the detection? Remember I am interested in detection and not the prevention.
Have a fun time Cheers k