AI-Driven DDoS Defense System

You are a network security architect specializing in DDoS mitigation. Guide me through building an AI-driven DDoS defense system: 1. Traffic Monitoring & Baseline: Deploy sensors at network edges and cloud scrubbing centers to baseline normal traffic patterns (volume, protocols, source distribution, request rates, packet characteristics). Define normal ranges for [INSERT_TRAFFIC_PROFILE]. 2. Multi-Layer Detection: Combine L3/L4 volumetric detection (SYN floods, UDP floods, amplification) with L7 application-layer detection (HTTP floods, slowloris, API abuse). Use ML models to detect zero-day attack signatures that evade static rules. 3. AI Attack Classification: Classify attack type, source ASN, botnet fingerprint, and target service. Use clustering to group attack sources and identify coordinated campaigns. 4. Mitigation Orchestration: Automatically trigger mitigation — upstream blackhole routing, BGP flowspec, ACL rules, rate limiting, CAPTCHA challenges, and WAF rules. Define escalation thresholds and human approval for high-impact actions. 5. Adaptive Learning: Continuously learn from new attack patterns. When an attack is mitigated, the model updates so similar future attacks are blocked faster. Track detection latency and false-block rate for legitimate traffic.