FATIMA JINNAH WOMEN UNIVERSITY
Department of Computer Science
CAPSTONE PROJECT REPORT
Real-Time DDoS Attack Detection System
Project Title
Real-Time DDoS Attack Detection System
Course
Capstone and Professional Practices
Submitted To
Ma'am Maham (Course Instructor)
University
Fatima Jinnah Women University
Session
2023 – 2027 (Batch BCS)
Submitted By
Name
Roll Number
Areeba Yasir
2023-BCS-016
Ibtisam
2023-BCS-042
Javeria Rahim
2023-BCS-046
Malayka Ibrar
2023-BCS-058
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
1. Executive Summary
This report presents the design, development, and implementation plan for a Real-Time DDoS Attack
Detection System — a capstone project undertaken by a team of four Computer Science students at Fatima
Jinnah Women University. The project addresses one of the most critical and growing threats in modern
cybersecurity: Distributed Denial of Service (DDoS) attacks.
The proposed system is built using Python and leverages tools such as Scapy or PyShark for packet capture,
a rule-based detection engine for anomaly identification, and a Flask-based dashboard for real-time
visualization. The goal is to deliver a functional prototype capable of monitoring network traffic, detecting
attack patterns, logging incidents, and alerting administrators — all in real time.
Key outcomes of this project include early attack detection, reduced false positives, improved network
visibility, and a prototype that can be extended with machine learning in future iterations. The system targets
practical cybersecurity needs applicable to organizations such as banks, hospitals, educational institutions,
and businesses.
2. Introduction
The internet has become the backbone of modern civilization. Almost every sector — banking, healthcare,
education, commerce — relies on continuous, uninterrupted network connectivity. With this deep
dependence, the security of these systems has become a matter of national and economic importance.
Among the most disruptive forms of cyberattacks is the Distributed Denial of Service (DDoS) attack. In a
DDoS attack, a large number of compromised systems (often a botnet) flood a target server with an
overwhelming volume of fake traffic. This causes the server to exhaust its resources, making it unavailable
to legitimate users. The consequences range from temporary service outages to severe financial and
reputational damage.
2.1 What is a DDoS Attack?
A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a
targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a
flood of internet traffic. DDoS attacks achieve effectiveness by utilizing multiple compromised computer
systems as sources of attack traffic. The key characteristics of DDoS attacks include:
•
Volume-based attacks: Flooding bandwidth with massive amounts of data (e.g., UDP floods, ICMP
floods)
•
Protocol attacks: Exploiting weaknesses in Layer 3/4 protocols (e.g., SYN floods, Ping of Death)
Page 2 | Capstone and Professional Practices
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
•
Application layer attacks: Targeting web servers by overwhelming application resources (e.g.,
HTTP floods)
2.2 Motivation
DDoS attacks have grown in both frequency and sophistication over recent years. Major organizations,
including government bodies, financial institutions, and healthcare providers, have suffered significant
downtime due to such attacks. Many existing intrusion detection systems (IDS) lack real-time capability,
produce high false-positive rates, or are too resource-intensive for deployment on standard hardware. This
project is motivated by the need for a lightweight, practical, and real-time detection solution.
3. Problem Statement
The increasing prevalence of DDoS attacks represents a severe challenge to the availability and reliability
of online services. While cybersecurity tools exist, they often fall short in real-time environments. The
specific problems this project addresses are:
#
Problem
Impact
1
Lack of Real-Time
Detection
Delayed identification allows attacks to cause prolonged service outages before
any response is triggered.
2
High False Alarm
Rate
Excessive false positives overwhelm administrators and erode trust in automated
detection systems.
Service Unavailability
Undetected attacks render systems inaccessible to legitimate users, causing
financial and reputational harm.
4
Lack of Traffic
Visibility
Without continuous monitoring, administrators cannot distinguish normal traffic
spikes from attack patterns.
5
Delayed Response to
Attacks
The absence of immediate alerts means response teams act after significant
damage has already occurred.
3
4. Project Objectives
The project aims to achieve the following objectives:
1
Simulate Traffic Scenarios
Page 3 | Capstone and Professional Practices
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
Generate both normal and malicious network traffic to test and validate the detection system under realistic
conditions.
Real-Time Traffic Monitoring
2
Capture and analyze live network packets continuously using Python-based packet capture tools
(Scapy/PyShark).
Rule-Based DDoS Detection
3
Implement threshold-based detection logic that classifies traffic as normal or anomalous based on defined
behavioral patterns.
Incident Logging
4
Maintain structured logs of all detected attack events, including timestamp, source IP, attack type, and
traffic volume.
Live Dashboard Development
5
Build an interactive Flask-based web dashboard to visualize traffic statistics and display real-time alerts.
Performance Evaluation
6
Measure system accuracy, detection latency, and false positive/negative rates to assess overall effectiveness.
5. Methodology
The development methodology follows a structured, iterative approach combining system design,
implementation, and continuous testing. The overall pipeline is described below.
5.1 System Architecture Overview
The system consists of four main layers working in sequence:
•
Traffic Input Layer: Captures raw network packets from the network interface using Scapy or
PyShark.
•
Feature Extraction Layer: Extracts relevant traffic features such as packet rate, source IP frequency,
protocol distribution, and request volume per second.
•
Detection Engine: Applies rule-based thresholds to classify traffic. Packets/connections exceeding
defined limits are flagged as potential DDoS traffic.
•
Visualization & Alert Layer: A Flask-based dashboard displays real-time charts using Chart.js and
generates alerts for flagged traffic.
5.2 Traffic Simulation
To test the system without exposing real infrastructure to attacks, the team will simulate both normal and
malicious traffic:
Page 4 | Capstone and Professional Practices
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
•
Normal traffic: HTTP requests, DNS queries, and standard TCP connections at typical rates.
•
Attack traffic: Simulated SYN floods, UDP floods, and HTTP floods using controlled scripts
targeting a local test server.
5.3 Feature Extraction
The following traffic features will be extracted and monitored in real time:
Feature
Description
Packet Rate (pps)
Number of packets received per second across all sources.
Source IP Frequency
Count of packets originating from a single IP within a time window.
Protocol Distribution
Ratio of TCP / UDP / ICMP packets in the traffic stream.
SYN/ACK Ratio
Measures incomplete TCP handshakes, a key indicator of SYN flood
attacks.
Request Volume
HTTP request count per second; spikes indicate application-layer attacks.
Payload Size
Average and max payload size per packet to detect volumetric anomalies.
5.4 Rule-Based Detection Engine
The detection engine operates on predefined threshold rules. When traffic metrics exceed these thresholds
within a defined time window (e.g., 5 seconds), the system triggers an alert. Example rules include:
•
If packet rate from a single IP exceeds 1000 pps within 5 seconds → Flag as potential DDoS
•
If SYN packets exceed 80% of all TCP packets → Flag as SYN flood
•
If HTTP requests exceed 500 per second from any source → Flag as HTTP flood
•
If ICMP packets exceed 500 pps → Flag as ICMP flood
All threshold values will be configurable through a settings file to allow tuning based on the network
environment.
5.5 Logging Mechanism
All detected incidents are logged in a structured format (CSV and/or SQLite database) with the following
fields: timestamp, source IP address, destination IP address, attack type, packet count, and severity level.
Logs are retained for post-incident analysis and performance evaluation.
5.6 Dashboard Development
Page 5 | Capstone and Professional Practices
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
A real-time web dashboard will be developed using Flask (Python backend) and Chart.js (frontend
visualization). The dashboard will provide:
•
Live traffic volume graph (packets/sec over time)
•
Active alert panel showing detected attack events
•
Source IP heatmap showing top talkers
•
Protocol distribution pie chart
•
Historical logs table with filtering and search capabilities
6. Tools and Technologies
Category
Tool / Technology
Purpose
Programming Language
Python 3.x
Core application logic, packet capture, detection
engine
Packet Capture
Scapy / PyShark
Raw network packet capture and analysis
Web Framework
Flask
Backend server, API endpoints, real-time alerts
Visualization
Chart.js
Frontend graphs and traffic visualization on
dashboard
Database/Logging
SQLite / CSV
Persistent storage of incident logs and traffic
records
Version Control
Git & GitHub
Collaborative development, code versioning,
backup
IDE
VS Code / PyCharm
Development environment for writing and
debugging code
OS
Windows 11 / Linux
Target deployment environment for system
testing
7. Literature Study
A review of existing literature and technologies provides important context for this project's design
decisions and identifies gaps the system seeks to address.
7.1 Existing DDoS Detection Approaches
Research in DDoS detection broadly falls into three categories:
Page 6 | Capstone and Professional Practices
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
•
Signature-based detection: Matches observed traffic against known attack patterns. Effective
against known attacks but fails against novel variants.
•
Anomaly-based detection: Establishes a traffic baseline and flags deviations. More adaptable but
prone to false positives during unusual but legitimate traffic spikes.
•
Machine learning-based detection: Uses trained classifiers (e.g., Random Forest, SVM, deep
learning) to identify attack patterns. High accuracy but computationally intensive and requires large
labeled datasets.
This project implements rule-based detection (a form of signature/anomaly hybrid), which provides the
advantages of speed and interpretability suitable for a prototype-phase system.
7.2 Relevant Tools and Frameworks
Scapy is a powerful Python library for packet manipulation and crafting. It allows the system to capture,
analyze, and even forge packets, making it ideal for both the detection and simulation components. PyShark
provides a Python wrapper around Wireshark's TShark, offering high-level packet parsing.
Flask is a micro web framework for Python that enables rapid development of web applications. Its
lightweight nature makes it suitable for building the dashboard without adding unnecessary overhead to the
detection system.
7.3 Gaps Addressed by This Project
Many existing solutions are either too heavyweight for deployment on standard systems or are commercial
products inaccessible to educational institutions. This project fills the gap by providing a lightweight, opensource, Python-based detection system suitable for academic study and practical deployment in small-tomedium environments.
8. Ethical Review
As a cybersecurity project involving network traffic analysis, the team has carefully considered the ethical
implications of the work.
8.1 Data Privacy
•
All traffic captured during development and testing is conducted on isolated, controlled lab
environments using locally generated synthetic traffic. No real user data is captured or stored.
•
IP addresses and other personally identifiable information (PII) in test traffic are anonymized or
randomly generated.
8.2 Responsible Use
Page 7 | Capstone and Professional Practices
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
•
The attack simulation components are strictly confined to a closed lab environment. No actual
attacks are launched against any external system, public server, or third-party infrastructure.
•
The codebase includes warnings against unauthorized use. The system is designed for defensive
monitoring purposes only.
8.3 Compliance
The project complies with the ethical guidelines set by Fatima Jinnah Women University and does not
involve any activity that could be construed as unauthorized access, interception of communications, or
violation of computer misuse laws.
9. Societal Impact
The Real-Time DDoS Attack Detection System has significant potential societal benefit across multiple
sectors:
Healthcare
Financial Services
Hospitals and healthcare systems that rely on
internet-connected infrastructure can benefit from
early detection systems that prevent downtime in
critical patient-care systems.
Banks and fintech companies face DDoS attacks
regularly. Real-time detection allows security teams
to respond quickly, minimizing financial losses and
protecting customer trust.
Education
Government Services
Universities and e-learning platforms are
increasingly targeted by DDoS attacks during
critical periods (exams, enrollment). Detection
systems protect academic continuity.
E-government portals and public service websites
are high-value targets. Detection systems support
national cybersecurity resilience.
Academic Contribution
SMEs and Startups
Small and medium enterprises often lack the
budget for enterprise-grade security. A lightweight
open-source tool provides accessible cybersecurity
capability.
The project contributes to the body of cybersecurity
knowledge available at the university level and
provides a foundation for future machine learningbased research.
10. Competitive Landscape
Page 8 | Capstone and Professional Practices
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
The following table compares this project against established commercial and open-source DDoS
detection solutions:
Feature
This Project
Snort IDS
Cloudflare
Wireshark
Real-Time Detection
Yes
Yes
Yes
No
Open Source
Yes
Yes
No
Yes
Python-Based
Yes
No
No
No
Live Dashboard
Yes
Limited
Yes
No
Rule-Based Engine
Yes
Yes
Yes
No
Future work
Plugins
Yes
No
Cost
Free
Free
Paid
Free
Ease of Setup
High
Medium
Low
Medium
ML Support (planned)
11. Expected Outcomes
Upon completion of this project, the following deliverables and outcomes are expected:
•
A fully functional Python-based DDoS detection prototype capable of operating on a local network.
•
A real-time web dashboard providing live visualization of network traffic and attack alerts.
•
A structured incident log database capturing all detected attack events.
•
A traffic simulation module for generating test scenarios (normal and attack traffic).
•
A performance evaluation report documenting detection accuracy, latency, and false positive rate.
•
Comprehensive project documentation including system design, code documentation, and user
guide.
The system will demonstrate practical application of cybersecurity concepts, Python programming, network
analysis, and web development — providing valuable hands-on experience for all team members.
12. Future Work and Extensions
While the current scope focuses on a rule-based prototype, several extensions are planned or recommended
for future development:
•
Machine Learning Integration: Train classifiers (e.g., Random Forest, LSTM) on labeled DDoS
datasets to improve detection accuracy and reduce false positives.
Page 9 | Capstone and Professional Practices
Real-Time DDoS Attack Detection System | Fatima Jinnah Women University
•
Automated IP Blocking: Integrate with firewall APIs (e.g., iptables on Linux) to automatically
block flagged source IPs in real time.
•
Multi-Protocol Support: Extend detection to cover DNS amplification attacks, NTP reflection, and
Slowloris HTTP attacks.
•
Cloud Deployment: Package the system as a containerized application (Docker) for deployment on
cloud platforms such as AWS or Azure.
•
Mobile Alert System: Add SMS or email notification for administrators when high-severity attacks
are detected.
13. Conclusion
The Real-Time DDoS Attack Detection System represents a timely and practical response to one of the
most persistent threats in modern cybersecurity. By combining Python-based packet capture, rule-based
anomaly detection, and a live web dashboard, the project delivers a functional, extensible prototype suitable
for academic demonstration and real-world application.
The project provides meaningful learning outcomes for the team, spanning network security, software
development, data analysis, and system design. The modular architecture ensures that the system can be
progressively enhanced — most notably through the planned integration of machine learning techniques —
making it a valuable long-term contribution to the university's cybersecurity research portfolio.
As DDoS attacks continue to grow in scale and sophistication, tools like this system will play an
increasingly important role in protecting the digital infrastructure that modern society depends upon.
14. References
[1] Cloudflare — What is a DDoS Attack? — https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/
[2] GeeksforGeeks — Introduction to Scapy (Python Packet Tool) — https://www.geeksforgeeks.org/python-scapyintroduction/
[3] Imperva — DDoS Attack Types and Mitigation — https://www.imperva.com/learn/ddos/ddos-attacks/
[4] Python Documentation — Socket Programming HOWTO — https://docs.python.org/3/howto/sockets.html
[5] Netscout Threat Intelligence — Annual DDoS Threat Report — https://www.netscout.com/threatreport/
[6] Flask Documentation — Building Web Dashboards — https://flask.palletsprojects.com/
Page 10 | Capstone and Professional Practices