DDoS Attack Detection and Mitigation

This dataset provides detailed records of DDoS attack incidents, including attack vectors, traffic volumes, source IP geolocation, mitigation strategies such as scrubbing center activation and BGP blackholing, and customer impact assessment. It enables comprehensive analysis of attack patterns, effectiveness of mitigation measures, and customer service impact, making it invaluable for security operations, threat intelligence, and service reliability monitoring.

  • last updated 1 Nov 2025
  • by GoMask
The brief that made it

DDoS attack pattern analysis and reporting

Sample rows

preview · 8 of 151 rows · all 19 columns
attack_idstringcustomer_impact_typestringattack_traffic_total_gbfloatscrubbing_center_activatedbooleansource_countrystringcustomer_idstringattack_start_timedatetimeattack_end_timedatetimeattack_vectorstringattack_traffic_peak_gbpsfloatsource_ipstringsource_regionstringsource_citystringscrubbing_center_locationstringbgp_blackholing_activatedbooleanmitigation_start_timedatetimemitigation_end_timedatetimecustomer_impact_duration_minutesintegernotesstring
A1B2-C3D4E5F6outage98003.2trueDEenterprise_00342024-05-08T10:04:21Z2024-05-08T12:27:56Zvolumetric528.4193.15.37.201BavariaMunichFrankfurttrue2024-05-08T10:08:40Z2024-05-08T12:18:31Z123Major outage across enterprise, mitigated by scrubbing and blackholing.
uni-42KRVQ90latency178.3falseCNuni_39872024-04-21T03:33:11Z2024-04-21T03:41:57Zprotocol16.6220.188.72.13GuangdongShenzhenblanktrue2024-04-21T03:34:50Z2024-04-21T03:39:34Z9Short protocol attack, managed by BGP blackholing.
F64D9E2Bnone0falseRUcust_20242024-05-13T14:55:01Z2024-05-13T15:12:23Zapplication-layer081.117.43.56MoscowMoscowblankfalseblankblank0False positive, no attack traffic detected.
test-MN7J9Q5Wnone42.7falseUStest_00192024-05-16T09:18:42Z2024-05-16T09:29:01Zvolumetric2.666.197.18.4TexasDallasblankfalseblankblank0Low volume volumetric scan, no mitigation required.
ORG-8YB2H3J1service degradation215.9trueNLorg_84722024-05-11T21:22:05Z2024-05-11T22:01:58Zvolumetric27.4145.96.21.139North HollandAmsterdamAmsterdamfalse2024-05-11T21:33:10Z2024-05-11T21:55:49Z29Moderate volumetric attack, scrubbing delayed mitigation.
E9F7A821G5Hlatency84.6falseBRcust_18442024-04-25T17:44:09Z2024-04-25T17:52:33Zprotocol9.3138.193.201.42São PauloSão Pauloblanktrue2024-04-25T17:45:30Z2024-04-25T17:48:59Z8Protocol flood, swift blackholing mitigated latency.
CUST-421B6FQ7outage59012.4trueAUcust_39212024-05-05T00:30:00Z2024-05-05T02:43:07Zvolumetric323.6121.88.157.249VictoriaMelbourneSydneytrue2024-05-05T00:33:21Z2024-05-05T02:33:45Z110High volume attack, multi-stage mitigation.
JX-2894LF7Gnone0falseblankuni_98522024-05-03T18:00:09Z2024-05-03T18:16:29Zapplication-layer0104.34.16.77blankblankblankfalseblankblank0GeoIP lookup failed, suspicious application-layer scan.

What the 151 rows show

from the 151-row sample

Outage (customer impact type) stands out: mean attack_traffic_total_gb is 88,051, against 119.7 for the rest.

  • 48%scrubbing_center_activated = true
  • 115.7median attack_traffic_total_gb
  • 3attack vectors
  • 15.6median attack_traffic_peak_gbps
  • 13median customer_impact_duration_minutes
Mean attack_traffic_total_gb by customer_impact_type151 rows
050k100k9.7none52 rows256.8service …41 rows88,051outage31 rows123.3latency27 rows
attack_traffic_total_gb151 rows, in bands of 20k
060120120076576080k140kattack_traffic_total_gb →

Median 115.7, from 0.0 to 130,001.

source_country147 rows with a value · 4 left blank
  1. US17
  2. CN9
  3. RU9
  4. ZA8
  5. DE7
  6. BR7
  7. SG7
  8. FR7
  9. IN7
  10. NL5
19 columns by typefrom the column list below
  • string 10
  • integer 1
  • float 2
  • datetime 4
  • boolean 2

Columns

19 columns in four groups
blueprint · 19 columns
columntypedescriptionexample
Text 10 columns
attack_idstringUnique identifier for each DDoS attack incidentuniqueA1B2-C3D4E5F6
customer_idstringUnique identifier for the affected customer or organizationenterprise_0034
attack_vectorstringType of attack vector used (e.g., volumetric, application-layer, protocol)volumetric · application-layer · protocolvolumetric
source_ipstringSource IP address of the attack traffic193.15.37.201
source_countrystringCountry of origin for the source IP (ISO 3166 country code)optionalDE
source_regionstringRegion or state of the source IP geolocationoptionalBavaria
source_citystringCity of the source IP geolocationoptionalMunich
scrubbing_center_locationstringLocation of the scrubbing center used (if activated)optionalFrankfurt
customer_impact_typestringType of impact experienced by the customer (e.g., service degradation, outage, latency)none · service degradation · outage · latency · optionaloutage
notesstringAdditional notes or comments about the attack or mitigationoptionalFalse alarm, no impact.
Numbers 3 columns
attack_traffic_peak_gbpsfloatPeak attack traffic volume in gigabits per second (Gbps)0 or more528.4
attack_traffic_total_gbfloatTotal attack traffic volume in gigabytes (GB)0 or more98003.2
customer_impact_duration_minutesintegerDuration of customer impact in minutes0 or more · optional123
Dates and times 4 columns
attack_start_timedatetimeTimestamp when the attack started2024-05-08T10:04:21Z
attack_end_timedatetimeTimestamp when the attack ended2024-05-08T12:27:56Z
mitigation_start_timedatetimeTimestamp when mitigation actions beganoptional2024-05-08T10:08:40Z
mitigation_end_timedatetimeTimestamp when mitigation actions endedoptional2024-05-08T12:18:31Z
True or false 2 columns
scrubbing_center_activatedbooleanIndicates if a scrubbing center was activated for mitigationtrue
bgp_blackholing_activatedbooleanIndicates if BGP blackholing was used as a mitigation strategytrue

Use it for

  • scrubbing cent…48%73 of 151 rowsmean attack traffic t…9.7none256.8serv…88.1kouta…123.3late…

    A technology dashboard

    The scrubbing_center_activated rate, attack_traffic_total_gb by customer_impact_type and a breakdown of source_country. Excel, Power BI or Tableau.

  • Why do the 31 outage rows have a mean attack_traffic_total_gb of 88,051?

    A root-cause class exercise

    Hand out the rows and one question. The answer is in the data, not in the brief.

  • A software demo

    Believable attacks with customer_id, attack_start_time and attack_end_time to fill a screen in front of a buyer.

Not quite right?

Make it yours.

Same 19 columns, your size and your rules. See 20 rows before you pay.

Preview 20 rows free

1,000 rows: $1.99 · 10,000: $12.99One-time. No subscription. All prices

This dataset151 rows19 columns
Yours1,000 rows19 columnssource_country: UK only

blueprint · ddos-attack-detection-and-mitigation

Behind this dataset

Same schema. As many rows as you need.

These 151 rows came out of a blueprint — 19 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.

Rules it was built with
  • Attack ID and detection timestamp
  • Target: destination IP address or prefix under attack
  • Attack vector: volumetric (UDP flood, ICMP flood), application (HTTP flood), protocol (SYN flood)
  • Attack traffic volume: Gbps or packets per second (pps)
  • Source IP geolocation and botnet identification
  • Mitigation method: scrubbing center, BGP blackhole, rate limiting, ACL filtering
  • Scrubbing center: traffic redirected for cleaning, then returned
  • Attack duration and time to mitigation
Rows
Open the blueprint in Data Factory

1 credit per row. Preview 20 rows free. Buy rows for the full run.

Exports
CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
Licence
yours to use, including commercially
API slug
ddos-attack-detection-and-mitigation

More in Technology

Browse all
Also in TechnologyDistributed Team Cybersecurity Incident LogsCustomer Support Ticket ResolutionIT Service Ticket ClassificationAll 1,966 datasets

What should your data show?

Preview 20 rows free
No signup. No card.