How I Built a Real-Time DDoS Detection Engine from Scratch

Introduction

Imagine you own a popular website. Thousands of people visit every day.

Then one morning, a hacker sends millions of fake requests to your server

all at once — trying to crash it. This is called a DDoS attack

(Distributed Denial of Service).

For HNG Stage 3, I was tasked with building a system that:

Watches all incoming web traffic in real time

Learns what "normal" traffic looks like

Automatically detects and blocks attackers

Sends instant Slack alerts

Shows everything on a live dashboard

Here's exactly how I built it — explained simply enough that

a complete beginner can follow along.

The Architecture — How Everything Connects

Think of the system like a security team for a building :

Internet → Nginx (doorman) → Nextcloud (the building)

↓

Access Log (visitor diary)

↓

Python Daemon (security guard reading the diary)

↓

┌──────────────────────────────┐

│ Detect attack → Ban IP │

│ Send Slack alert │

│ Show on live…