<![CDATA[Distributed Denial of Service (DDoS) attacks pose a major threat to web server availability, flooding servers with excessive traffic until Legitimate users can no longer reach the service. This study designs an Intrusion Prevention System (IPS) integrating Random Forest-based DDoS detection with iptables hashlimit rate limiting for automatic mitigation on an NGINX web server, reading traffic in real time from access logs rather than raw packet capture; its novelty lies in this end-to-end detection-mitigation integration rather than the individual algorithms. The model was trained on CIC-DDoS2019, mapped to eight deployment-consistent flow features across five classes: BENIGN, Syn, TFTP, DrDoS_UDP, and DrDoS_DNS. Random Forest reached 99.35% accuracy and 0.96 macro F1-score, outperformed Decision tree, SVM, and Logistic Regression baselines, and correctly flagged 99.67% of unseen attack samples as malicious, though BENIGN precision was only 69%. Rate limiting cut packet count by 99.65% (4,938.10 to 17.42 packets per interval) and CPU usage from 28.18% to 11.36%, with detection latency averaging 542.27 ms and iptables execution of just 3.84 ms. Legitimate-user testing showed 100% success rate and zero false positives when Attacker and Legitimate IPs differed, but revealed two limits of IP-based mitigation: shared-IP/NAT users suffered about 103 seconds of disruption from collateral blocking, and concurrent Legitimate traffic near the rate threshold triggered false positives in 5% of intervals. These results show Random Forest combined with iptables-based rate limiting mitigates DDoS effectively while exposing trade-offs between detection accuracy and service availability for real-world deployment.]]>
Copyrights © 2026
