ddos-detection-shield

DDoS Detection Shield - ML Model

Pre-trained PPO (Proximal Policy Optimization) model for DDoS/DoS attack detection.

Model Details

• Type: Reinforcement Learning (PPO)
• Framework: Stable Baselines3
• Task: Network attack detection and classification
• Input: Request metrics (rate, path, payload analysis)
• Output: Attack classification (block, alert, isolate, ignore)

Performance

• Detection Accuracy: 98%+
• False Positive Rate: < 2%
• Latency: < 15ms per request

Usage

import sys
sys.path.insert(0, 'backend')
from detection_engine import engine

result = engine.analyze_request(
    source_ip="192.168.1.1",
    request_data={
        "path": "/api/endpoint",
        "method": "GET",
        "body": "",
        "headers": {},
        "port": 443,
        "protocol": "https"
    }
)

print(f"Score: {result['detection_score']}")
print(f"Attack Type: {result['attack_type']}")
print(f"Severity: {result['severity']}")

Detection Features

• DDoS Detection: Identifies high request rates (>5 req/s)
• SQL Injection: Detects SQL keywords and patterns
• XSS Attacks: Identifies script tags and malicious payloads
• Brute Force: Detects login attempt patterns
• Path Scanning: Identifies enumeration attacks

Repository

See the main repository for complete setup and deployment instructions: https://github.com/anomalyco/ddos-detection-shield

License

MIT License