> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/network-ddos/faq/how-network-ddos-detects-and-mitigates-attacks.md).

# How Network DDoS Detects and Mitigates Attacks

The Link11 solution combines *proactive attack detection* with *precise mitigation* to ensure robust, adaptive defense. Here’s how it protects your infrastructure.

{% hint style="info" %}
Below, we describe the processes that occur when Network DDoS analyzes incoming traffic. The options for determining how and when that traffic is routed into Link11 for analysis are described [here](/product-guides/network-ddos-v3/architecture-and-setup-options.md#routing-traffic-into-infra-ddos).
{% endhint %}

***

## 1. Always-on monitoring and smart detection

DDoS attacks are designed to overwhelm your destination servers with a flood of malicious traffic. To counter this, our system continuously monitors *incoming traffic* directed to your infrastructure, analyzing both its structure and behavior. Detection is multi-layered and thorough, ensuring precision and minimal false positives.

* **Layer 1: Traffic Structure Analysis**\
  At this foundational layer, we analyze the core attributes of every incoming packet to identify unusual patterns:
  * **Packet Header Integrity Checks**: Ensuring packets conform to expected standards and are not malformed, a common tactic in some DDoS attacks.
  * **Protocol-Port Matching**: Verifying that protocols (e.g., TCP, UDP, ICMP) are being used correctly with destination ports (e.g., web traffic over HTTP/S ports). Unexpected combinations could indicate malicious activity.
  * **Fragmentation Analysis**: Detecting unusually fragmented packets, which attackers sometimes use to bypass detection systems.
* **Layer 2: List-Based Checks**\
  The second layer filters traffic using pre-defined and dynamic lists:
  * **Whitelist Validation**: Traffic from trusted IPs or ranges is fast-tracked to reduce processing overhead.
  * **Blacklist Filtering**: Known malicious sources are blocked immediately. Our blacklist is dynamically updated to include the latest threat intelligence feeds.
  * **Geo-Based Filtering**: Traffic from regions with no business relevance or historically associated with attacks can be flagged or restricted.
* **Layer 3: Protocol-Based Thresholds**\
  The third layer enforces rate limits and thresholds tailored to your infrastructure:
  * **Packets Per Second** (PPS): Monitoring for spikes in packet volume that exceed expected levels.
  * **Connection Rates**: Watching for excessive new TCP connections (e.g., SYN floods) or rapid reconnections.
  * **Amplification Vectors**: Monitoring for Amplification type attacks (UDP, Citrix, etc)
* **Layer 4: Advanced Machine Learning (ML)**\
  Finally, our clustering model uses machine learning to distinguish between normal and anomalous traffic:
  * **Behavioral Profiling**: By understanding the typical patterns of your traffic, the ML model detects outliers that don’t fit normal clusters.
  * **Adapting to Change**: The model uses shifting windows to continually update its understanding of your traffic patterns, ensuring accuracy even as your application evolves.

When a DDoS attack is detected, the system triggers Attack Mode, a specialized phase that shifts the focus from destination analysis to source-based filtering.

***

## 2. Swift and accurate attack mitigation

During an attack, the priority shifts to evaluating *where the traffic is coming from* to stop the sources of malicious requests while preserving access for legitimate users. Mitigation operates in a highly targeted and efficient manner:

* **Dynamic Source Evaluation**\
  Incoming traffic is analyzed at the source IP level using a mix of algorithms and heuristics, such as:
  * **Source Rate Limits**: Blocking IPs that exceed thresholds for requests, packets, or connection attempts during the attack window.
  * **Packet Content Analysis**: Inspecting packet content and blocking IPs based on malformed or anomalous packet data.
  * **Anomaly Detection**: Identifying sources whose traffic characteristics deviate significantly from the expected profile for legitimate users.

Critically, during "peace time", our system allows traffic that may have exceeded thresholds to pass, however *during an attack* these IPs would be blocked. This ensures that aggressive, but non-malicious users (e.g., legitimate crawlers or burst traffic from legitimate sources) aren’t unnecessarily penalized unless there is a major shift in traffic patterns. If there are known source IPs that always need to be allowed to pass, these should be whitelisted.

***

## 3. Post-attack recovery

Once the attack has ended, the system transitions out of Attack Mode and resumes its normal monitoring state:

* **Blocking Rules Reset**: Temporary mitigation rules are removed to restore normal traffic flow.
* **Attack Reporting**: Attack Reports are generated containing the details of the attack and IPs that were blocked.

This seamless recovery ensures that your services continue to operate smoothly, with minimal disruption to your users or operations.