My testbed needs a DDoS detection script or program/software. After detection I will use my solution to do measurements after.

Do I need to count the number of packets per second and use a threshold mechanism for detection? Or should I have to think about extraction of some specific parameter which would point to a DDoS attack?

I have seen in the market where machine learning algorithms are used for anomaly detection. In my scenarion I will be generating UDP, TCP, HTTP-GET floods. For the what is the right way to do the detection? Remember I am interested in detection and not the prevention.

Have a fun time Cheers k


If you just want to detect floods, you can simply define a rate limit and when this is exceeded raise an alarm.

A more machine-learning like way would be: Train an anomaly detection algorithm with legitimate traffic. So you have to chose your features (e.g. packets per second, burst lengths, etc.) and then train you system. Finally you can then just measure the features while operating you network and feed it into the anomaly detector.

| improve this answer | |
  • I am going to implement it. I will come back to share my experience. Thanks – Khawar Shehzad Sep 1 '15 at 13:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.