This is really nice! Have you looked at using stream processors such as ksql for the ddos detection?