Analysis of DDoS Attack Patterns and Mitigation Techniques

A full-stack cybersecurity dashboard that simulates real-time DDoS attack analysis and demonstrates how layered detection plus mitigation controls can reduce attack impact.

Live demo: https://ddos-analysis-mitigation-dashboard.netlify.app

Overview

This project was built to explain how a modern DDoS detection system should work in practice. Instead of relying on one simple rule like "traffic is high", the system evaluates traffic across multiple perspectives and raises alerts only when several indicators agree.

The dashboard continuously models:

• Time-based baseline deviation
• Repetitive and bot-like request behavior
• Entropy changes in source IP and port distribution
• Protocol-level misuse such as SYN flood, UDP flood, and HTTP flood patterns
• Lightweight anomaly-model confirmation

It then combines those signals into a hybrid decision engine that reduces false positives while still surfacing suspicious multi-layer behavior.

Key Features

• Real-time dashboard refresh every 3 seconds
• Cyber-themed UI with 3D-inspired visual styling
• Scenario simulation for:
  • Normal traffic
  • TCP SYN flood
  • UDP flood
  • HTTP flood
  • Multi-vector attack
• Layered DDoS analysis using:
  • Adaptive moving baseline analysis
  • Behavior-based traffic analysis
  • Entropy analysis
  • Protocol-level validation
  • Lightweight anomaly detection
• Interactive mitigation controls:
  • Block IPs
  • Rate limit traffic
  • Filter malicious packets
  • Apply firewall rules
• Suspicious IP table, traffic chart, incident queue, detection verdict, recommendations, and response timeline
• Netlify-ready deployment using serverless functions

Detection Logic

The dashboard models a hybrid DDoS detection workflow:

1. Traffic capture and feature extraction
2. Baseline learning from recent time windows
3. Behavior comparison against expected browsing/session patterns
4. Entropy change detection for distributed anomalies
5. Protocol validation for misuse and half-open connections
6. Anomaly scoring
7. Consensus-based decision engine

An attack is not treated as confirmed based on one noisy metric. The system needs agreement across multiple layers before escalating confidence.

Mitigation Strategy

Once suspicious behavior is detected, the platform can simulate how mitigation controls affect the traffic profile:

• Block IPs: stops the most abusive sources
• Rate limit traffic: reduces volumetric bursts
• Filter malicious packets: suppresses malformed or abnormal packet patterns
• Use firewall rules: applies protocol-aware defensive controls

These controls feed back into the dashboard so the user can observe how risk and signal confidence change after mitigation.

Tech Stack

• Frontend: HTML, CSS, Vanilla JavaScript
• Backend: Node.js, Express
• Deployment: Netlify + Netlify Functions

Local Development

Install dependencies and start the app:

npm install
npm start

Open: http://localhost:3000

For watch mode:

npm run dev

API Endpoints

Local Express server:

• GET /api/meta
• GET /api/dashboard
• POST /api/dashboard
• POST /api/scenario
• POST /api/mitigations/:id
• POST /api/reset

Netlify Functions:

• GET /.netlify/functions/meta
• GET /.netlify/functions/dashboard
• POST /.netlify/functions/dashboard

Production routing exposes the serverless API as:

• GET /api/meta
• GET /api/dashboard
• POST /api/dashboard

Project Structure

.
|-- netlify/
|   `-- functions/
|       |-- dashboard.js
|       `-- meta.js
|-- public/
|   |-- app.js
|   |-- index.html
|   `-- styles.css
|-- src/
|   |-- dashboard.js
|   |-- data.js
|   `-- state.js
|-- .gitignore
|-- netlify.toml
|-- package.json
|-- README.md
`-- server.js

Netlify Deployment

This project is configured for Netlify with:

• Static frontend from public/
• Serverless API functions in netlify/functions/
• Shared detection logic in src/

Production URL: https://ddos-analysis-mitigation-dashboard.netlify.app

Future Improvements

• Connect to real packet capture or CSV/PCAP data from Wireshark or tcpdump
• Persist attack sessions and reports in a database
• Add authentication and user-specific dashboards
• Export incident reports as PDF or CSV
• Add historical comparison charts and trend analytics

License

This project is licensed under the MIT License.