Week 13 Mini Project: DDoS Mitigation Layer

Build a complete DDoS mitigation proxy that sits in front of any HTTP backend.

Architecture

Internet
    │
    ▼
[TCP Listener — ProtectedListener (SYN flood defense)]
    │
    ▼
[SlowlorisDetector — byte rate monitor per connection]
    │
    ▼
[CIDRRateLimiter — per-IP + per-/24 token bucket]
    │
    ▼
[TrafficAnalyzer — EMA z-score anomaly detection]
    │
    ▼
[TieredResponder — score → allow / PoW challenge / block]
    │
    ▼
[ThreatIntel — aggregate scores from all modules]
    │
    ▼
[HTTP Reverse Proxy → Backend]

Feature Checklist

• Per-IP token bucket (100 req/s, burst 200)
• Per-/24 subnet token bucket (500 req/s, burst 1000)
• IPv6 /48 grouping
• Slowloris detection (< 50 bytes/sec during header phase)
• SYN flood defense (max 5 half-open per IP, 3s drain)
• Traffic anomaly (z-score > 3.0 → flag)
• PoW challenge at score 50–80 (SHA256, difficulty=16)
• Block at score > 80 (5-minute expiry)
• CIDR whitelist (bypass all mitigations for trusted ranges)
• /debug/ddos endpoint: JSON stats (top IPs, block list, attack status, request rates)
• Integration with ThreatIntel store (signals feed back into score)
• Anti-amplification UDP service (response ≤ 1.5× request)

/debug/ddos Response Format

{
  "blocked_ips": ["1.2.3.4", "5.6.7.0/24"],
  "top_request_rates": [
    {"ip": "1.2.3.4", "rate_per_sec": 847.2, "z_score": 4.1}
  ],
  "slowloris_detected": 3,
  "syn_flood_blocked": 12,
  "pow_challenges_issued": 47,
  "pow_challenges_solved": 2,
  "amp_attempts_blocked": 0,
  "current_block_list_size": 8
}

Key Packages

net, net/http, sync, sync/atomic, crypto/sha256, crypto/hmac, crypto/rand, math, time

Engineer Takeaway

Cloudflare Magic Transit, AWS Shield Advanced, and Akamai Prolexic implement this logic at 100 Tbps scale. Their edge nodes run rate limiting at line rate using eBPF/XDP. The core algorithms — token bucket, z-score anomaly, PoW — are identical to what you've built. The difference is hardware, not ideas.