Real-Time Distributed Denial of Service Attack Detection and Automated Mitigation Using Machine Learning and Event-Driven Architecture

Abstract

Distributed Denial of Service (DDoS) attacks continue to threaten modern network infrastructures by disrupting service availability, yet many machine learning-based detection methods remain limited to offline evaluation and lacks integrated real-time mitigation. This paper presents DDoS-Shield, an end-to-end event-driven framework that combines live packet capture, Apache Kafka-based stream processing, machine learning inference, and automated response within a production-oriented architecture. Unlike conventional approaches that rely solely on flow-level classification, the proposed framework incorporates a Temporal Attack Confirmation stage that verifies sustained malicious activity using sliding-window aggregation before triggering IP blacklisting and administrator alerts, thereby reducing transient false positives during automated mitigation. The framework performs real-time feature extraction directly from raw packet streams without requiring pre-computed flow files and is validated using both the CICDDoS2019 benchmark dataset and a live deployment. Six machine learning classifiers were evaluated, with Gradient Boosting achieving the best performance (95.37% accuracy and ROC-AUC of 1.00) and consistently maintaining sub-second end-to-end detection latency. Operational validation on 237,772 live traffic flows further demonstrates the practicality of the proposed architecture for continuous DDoS detection and automated mitigation in enterprise-scale environments.