Autonomous DDoS Detection & Response System

• 

  test endpoint showing ALL CHECKS PASSED + Splunk MCP Token Found ✅

• 

  Splunk Dashboard with 1,794 events, 678 DDoS, Splunk AI prediction panel

• 

  Splunk MCP Server active with endpoints

• 

  /mcp_query terminal showing Groq AI analysis + raw Splunk data

Inspiration

DDoS attacks cost companies millions every year. Existing tools detect attacks but require human analysts to investigate and respond. I wanted to build a fully autonomous system that detects, investigates, and responds without any human in the loop — using Splunk's native AI capabilities at the core.

What it does

Real-time DDoS detection pipeline that classifies network traffic using a trained Random Forest ML model, streams all events into Splunk via HEC, visualizes attacks on a live dashboard with native ML predictions, queries Splunk data autonomously via MCP Server, triggers real-time alerts on attack thresholds, and automatically generates AI-powered incident reports — fully autonomous, zero human intervention.

How we built it

Trained a Random Forest model on the SDN benchmark dataset (104K rows, 99.98% accuracy). Built a Flask backend with /predict, /simulate, /agent, /mcp_query, and /test endpoints. Integrated Splunk HEC to stream every prediction as a real-time event. Built a Classic Dashboard in Splunk showing live traffic charts and severity tables. Added Splunk's native predict command for real-time traffic forecasting using Splunk's built-in ML. Installed Splunk MCP Server and built an agentic /mcp_query endpoint that queries Splunk via MCP protocol using splunk_run_query, then feeds results into Groq AI (llama-3.3-70b) for autonomous cybersecurity analysis. Created a real-time Splunk Alert that triggers when DDoS attacks exceed threshold.

Challenges we ran into

Splunk HEC SSL configuration on local setup, Groq API quota limits during development, configuring Splunk MCP Server encrypted token authentication, and making the simulation feel realistic while replaying a benchmark dataset.

Accomplishments that we're proud of

Full end-to-end autonomous pipeline working in real-time. 99.98% model accuracy. Live Splunk dashboard updating with every prediction. Splunk MCP Server connected and returning live query results analyzed by Groq AI. Real-time Splunk Alert firing on DDoS threshold. AI-generated incident reports with severity, IOC indicators, and recommended actions — all triggered automatically.

What we learned

Deep integration between ML models and Splunk HEC, building autonomous AI agents using Splunk MCP Server, how the Model Context Protocol enables secure AI-to-Splunk communication, Splunk's native ML predict command, and how real SOC pipelines work end to end.

What's next for Autonomous DDoS Detection & Response System

Splunk SOAR playbook for automated IP blocking, Splunk AI Assistant integration for natural language SPL generation, Splunk Hosted Models (Foundation AI Security Model) for enhanced threat detection, PagerDuty webhook alerts, retraining on real network traffic captures, and multi-model ensemble for improved accuracy.

Built With

• flask
• groq
• llama-3.3-70b
• python
• random-forest
• scikit-learn
• sdn-dataset
• splunk-alerts
• splunk-enterprise
• splunk-hec
• splunk-mcp-server
• splunk-predict