This project is part of the HNG DevOps internship (Stage 3), and trust me, it sounds way more complicated than it actually is. Let's break it down together.
What Are We Building?
Think of it like hiring a smart security guard for your website who:
Watches the door - Keeps track of everyone visiting your site
Learns the pattern - Figures out what "normal" traffic looks like
Spots the troublemakers - Detects when something fishy is happening
Takes action - Blocks suspicious visitors automatically
Sends you alerts - Notifies you on Slack when there's trouble
Shows a dashboard - Gives you a live view of what's happening
Cool, right? Let's see how it all works!
Understanding the Key Concepts (No Jargon, I Promise!)
1. The Sliding Window (Think: Security Camera Footage)
Imagine you have a camera recording your front door. Instead of keeping all footage forever, you only keep the last 60 seconds. When a new second is recorded, the oldest one gets deleted.
In our system:
- We track how many people visited in the last 60 seconds
- Every second, we add new data and remove the oldest
- This gives us a "rolling" view of recent activity
Why is this useful?
It helps us spot sudden spikes in traffic that might indicate an attack!
# Simple example (Python makes this easy!)
from collections import deque
# This automatically keeps only the last 60 items
recent_traffic = deque(maxlen=60)
# Every second, we add new data
recent_traffic.append(current_visitors)
# Old data automatically disappears!
2. The Baseline (Your "Normal" Traffic Pattern)
Your baseline is like knowing your daily routine. If you usually get 10-15 visitors per second, that's your "normal."
How we calculate it:
- Watch traffic for 30 minutes
- Calculate the average (mean)
- Calculate how much it varies (standard deviation)
Example:
- Normal traffic: 13 visitors/second ± 2
- This means 11-15 is totally normal
- But 50 visitors/second? That's suspicious!
import statistics
# Collect 30 minutes of data
traffic_data = [12, 15, 13, 14, 16, 11, 12, ...]
# Calculate your "normal"
average = statistics.mean(traffic_data) # Example: 13.5
variation = statistics.stdev(traffic_data) # Example: 2.1
3. The Z-Score (How Weird is This Traffic?)
The z-score is just a fancy way of asking: "How unusual is this compared to normal?"
Simple formula:
z-score = (current traffic - normal traffic) / variation
What it means:
- Z-score of 0 = Perfectly normal
- Z-score of 1-2 = A bit high, but okay
- Z-score of 3+ = ALERT! Something's wrong!
Real example:
normal = 13.5 visitors/second
variation = 2.1
current = 30 visitors/second
z_score = (30 - 13.5) / 2.1
# Result: 7.86 — Definitely an attack!
if z_score > 3.0:
print("🚨 ATTACK DETECTED!")
4. The 5x Rule (Backup Check)
Sometimes the z-score isn't enough. The 5x rule is simple:
If traffic is 5 times higher than normal, it's an attack — no matter what!
Why? If you normally get 2 visitors/second, even 10 might not trigger the z-score, but it's still 5x your normal traffic!
Setting Up Your Project
What You'll Need
A Google Cloud account (free tier works!)
A Slack account (to receive alerts)
Basic knowledge of:
- Running commands in terminal
- What Docker is (even just a basic idea)
- Python basics (if statements, loops)
Step 1: Create Your Cloud Server
- Go to
- 🐳
Good luck, and happy coding! 🚀
P.S. If you found this helpful, give it a ❤️ and follow me for more DevOps tutorials!
SOCIAL SHARE CARD GENERATOR