A real-time DDoS attack detection and mitigation system with AI-powered threat analysis, interactive dashboard, and automated firewall management.

• Real-time Monitoring: Live traffic analysis with WebSocket support
• AI-Powered Detection: Machine learning algorithms to detect anomalies and threats
• Interactive Dashboard: Modern React-based UI with charts and visualizations
• Automated Mitigation: Auto-blocking of suspicious IPs with configurable thresholds
• GeoIP Intelligence: Location-based blocking and analysis
• IP Management: Whitelist/blacklist management interface
• Analytics: Detailed attack patterns and traffic analysis
• Settings Management: Configurable protection parameters

ddos-shield/
├── backend/           # Node.js + Express backend
│   ├── src/
│   │   ├── core/     # Detection engine, firewall, AI analyzer
│   │   ├── routes/   # API routes (auth, admin)
│   │   ├── services/ # IP service, GeoIP, auth
│   │   ├── realtime/ # Socket.IO server
│   │   └── middleware/# Auth, rate limiting
│   └── ecosystem.config.js
├── frontend/          # React + Vite frontend
│   ├── src/
│   │   ├── components/ # Reusable UI components
│   │   ├── pages/      # Dashboard pages
│   │   └── services/   # API & socket services
│   └── public/
├── config/            # Configuration files
└── docker-compose.yml

• Node.js 18+
• MongoDB
• Redis
• iptables (for firewall functionality)

cd backend
npm install
cp .env.example .env
# Edit .env with your configuration
npm run dev

cd frontend
npm install
cp .env.example .env
# Edit .env with your API URL
npm run dev

docker-compose up -d

PORT=3000
NODE_ENV=development
JWT_SECRET=your-super-secret-jwt-key
MONGO_URI=mongodb://localhost:27017/ddos-shield
REDIS_HOST=localhost
REDIS_PORT=6379
CORS_ORIGIN=http://localhost:5173

VITE_API_URL=http://localhost:3000
VITE_SOCKET_URL=http://localhost:3000

• POST /api/auth/register - Register new user
• POST /api/auth/login - Login user
• GET /api/auth/me - Get current user
• POST /api/auth/logout - Logout user

• GET /api/admin/stats - Get dashboard statistics
• GET /api/admin/attacks - Get attack logs
• GET /api/admin/ips - Get IP list
• GET /api/admin/top-ips - Get top offending IPs
• GET /api/admin/attack-types - Get attack type distribution
• POST /api/admin/block - Block an IP
• POST /api/admin/unblock - Unblock an IP
• POST /api/admin/bulk-block - Bulk block IPs
• POST /api/admin/whitelist - Whitelist an IP
• POST /api/admin/unwhitelist - Remove from whitelist
• GET /api/admin/settings - Get settings
• POST /api/admin/settings - Update settings

• detection_update - Real-time detection results
• critical_alert - Critical threat alerts
• auto_blocked - Auto-block notifications
• ip_blocked - Manual block notifications
• ip_unblocked - Unblock notifications
• settings - Settings updates

• update_settings - Update detection settings
• block_ip - Block an IP
• unblock_ip - Unblock an IP

MIT