How to Analyse a DDoS Quackly
summary
A DuckDB-based packet dissector replaces an in-memory pandas/DataFrame pipeline with on-disk Parquet processing and produces JSON “fingerprints” of DDoS attack factors. Using the University of Trento botnet dataset of nearly 6 million packets, the original DataFrame approach uses ~75% RAM and takes ~12 minutes; the DuckDB dissector drops memory use to near zero and runs in 1m14s (another test falls from 18m to 4m40s). Translating PCAP → Parquet inflates size ~50% and dominates runtime, but the end-to-end tool is markedly faster and stable.
AI-written summary · about
related talks
19mDDoS Detection at the Scale of One Hundred Tbps
52mInvestigating DDOS - Architecture Actors and Attribution
37mAnatomy of a DDoS
22mdShark: A General, Easy to Program and Scalable Framework for Analyzing In-network
12mBridging Missing Gaps in Evaluating DDoS Research
25mStorage and encryption in DuckDB
07mHow NOT to use DuckDB: How we introduced a CVSS 9.9 vulnerability into
48mDDoS Attacks in Russia in 2014: UDP Packets Don’t Smell of Lard