DoS Lab 01 — DDoS Classification & Mitigation Planner
WARMUP: Chapters 2–5 (taxonomy, amplification, mitigation stack).
Threat model
A DoS takes you offline; the failure mode this lab targets is applying the wrong mitigation — trying to rate-limit a 400 Gbps volumetric flood, blocking the (innocent, spoofed) source IPs of a reflection attack, or assuming a CDN covers a protocol flood. This engine classifies an attack by vector → layer, recommends the matching mitigation, evaluates a proposed plan, and answers whether blocking source IPs would even help.
What you build (lab.py)
classify(attack)→{layer, recommended}(protocol / volumetric / application).recommend(attack)→ the matching mitigations.evaluate_plan(attack, chosen)→{effective, ineffective, missing}— catches mismatched controls.would_blocking_sources_help(attack)→ False for spoofed/amplified reflection.
Attack cases the tests cover
- Layers classified per vector; rate-limiting is ineffective against a volumetric amplification attack (and the correct anycast/scrubbing shows as missing); a correct SYN-flood plan is effective; partial plans report what's missing; blocking source IPs is useless for spoofed/amplified reflection but can help for an L7 flood from real clients.
Run
pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q
Hardening / extensions
- Recommend by combined signal (rate + cacheable + spoofed), not just vector.
- Add a cost/SLA model (when to engage always-on vs on-demand scrubbing).
- Produce an incident runbook step list per classification.
Interview / resume
"Built a DDoS classification and mitigation planner that maps each attack class to the mitigation layer that actually works and flags mismatches — encoding that you can't rate-limit a volumetric flood or block the spoofed sources of a reflection attack."
Limitations: rule-based over attack descriptors; the vector→mitigation table is representative, not exhaustive.