How I Built a Real-Time DDoS Detection Engine From Scratch (And What I Learned)

How I Built a Real-Time DDoS Detection Engine From Scratch (And What I Learned) A few weeks ago I was given a task that sounded simple on paper: watch incoming HTTP traffic, figure out what "normal" looks like, and automatically block anything that looks like an attack. No third-party tools. No Fail2Ban. Just raw Python, some math, and a Linux firewall. This post is my attempt to explain how I built it, in plain English, for someone who has never touched security tooling before. WHY THIS PROBLEM