Documentation

AI Settings

Configure AI and machine-learning parameters that control how the platform detects attacks.

Overview

The AI Settings page lets you view and adjust the parameters used by the DeDDoS AI and machine-learning detection models: the Isolation Forest and Robust Z-Score models for TCP/UDP/ICMP floods, the LSTM autoencoder models for DNS and NTP floods, and the Layer 7 (HTTP) detectors. These settings control how models are trained, how much data they analyze, and how sensitive they are to anomalies. Changing a value here affects future detection behavior across the entire platform.

Use this page to:

Review the current AI detection configuration, grouped into collapsible families.
Find a setting quickly by searching its name or description.
Tune training data sizes, retrain intervals and time windows for the detection models.
Adjust contamination rates that control how aggressively models flag anomalies.
Set Z-Score thresholds and sliding-window lengths for the statistical detectors.

All settings on this page are predefined by the system. You can edit their values but cannot add or remove settings.

How to Open This Page

Click Administration in the top navigation bar.
Click the AI tab (microchip icon) in the Administration tab strip.

The page opens at /administration/ai and the settings list loads automatically.

Permission required: Your account must belong to a group that has the Modify Settings or View Settings permission. With View Settings only, you can browse and search the list, but the edit buttons are replaced by a dash (—, “Read-only access”). If the AI tab does not appear, ask an administrator to grant one of these permissions to your group.

Main Areas

The page lists all 42 AI parameters, organized into collapsible setting groups.

1 Administration tab strip – switch between administration sections. The AI tab is highlighted while you are on this page.
2 Search field – type part of a setting name or description to filter the list. A clear button (×) appears while a term is entered; pressing Esc in the field also clears it.
3 Expand all / Collapse all – open or close every setting group with one click. These buttons are hidden while a search term is active.
4 Group header – the name of a setting group, the number of settings it contains, and a chevron. Click the header to collapse or expand that group.
5 Settings rows – one row per setting, with three columns: Name, Value, and Actions.
6 Edit button (pencil icon) – opens the Edit Setting dialog for that row.

Setting Groups

Settings are grouped by the model or detector that uses them. The groups appear in this order:

Group	Settings	Contents
Training data & retraining	3	`DAYS_OF_TRAINING_DATA`, `MAX_DOC_COUNT`, `RETRAIN_INTERVAL`
Volumetric DDoS sampling	2	`DDOS_ALLOWED_LATENESS`, `DDoS_TIME_WINDOW_SECONDS`
LSTM models	5	DNS/NTP LSTM autoencoder settings (`LSTM_*`)
Isolation Forest	2	Isolation Forest training settings (`IFOREST_*`)
Robust Z-Score	9	Z-Score scaling, window length and per-protocol thresholds (`ZSCORE_*`)
Attacker detection	2	Attacker-identification thresholds (`ATTACKER_DETECTION_*`)
Layer 7 volume detector	6	`L7_VOLUME_*` and `L7_HISTORY_WINDOW_LENGTH`
Layer 7 compute detector	5	`L7_COMPUTE_*`
Layer 7 slow-attack detector	6	`L7_SLOW_*`
Layer 7 oversized-header detector	2	`L7_OVERSIZED_*`

Collapsing Groups

Click a group header to collapse it, or use Collapse all and then open only the group you are working on. The collapsed/expanded arrangement is saved in your browser (local storage) separately for each settings page, so it is kept when you switch between administration sections or reload the page.

While a search term is active, every matching setting is shown even if its group is collapsed. When you clear the search, your saved arrangement returns. If nothing matches, the page shows “No settings match” followed by your search term.

Table Columns

Column	Description
Name	A question-mark icon (hover or focus it to see a short help tip), followed by the setting’s display label (for example Days of training data), then the internal setting name and the description in small text. The internal name is shown without its `AI#` database prefix and with underscores replaced by spaces – for example, `AI#DAYS_OF_TRAINING_DATA` appears as DAYS OF TRAINING DATA.
Value	The current value, with its unit underneath (for example days, seconds or robust z-score (σ)). ZSCORE_LOG_SCALE is an on/off flag and has no unit.
Actions	The edit button (pencil icon). Read-only users see a dash instead.

Settings Reference

The tables below list every AI setting, in the groups shown on the page. Default is the value seeded at installation. Accepted range is enforced in the edit dialog and again by the server when you save (see Validation Rules). Every setting except ZSCORE_LOG_SCALE has an accepted range; ZSCORE_LOG_SCALE shows only its default.

Training data & retraining

Setting	Type	Default	Accepted range	Purpose
DAYS_OF_TRAINING_DATA	Integer	7	1 – 365 days	Number of days of historical data used to train the L3/L4 detection models (Isolation Forest, Z-Score and LSTM).
MAX_DOC_COUNT	Integer	20000	100 – 10,000,000 records	Maximum number of documents retrieved from the database in a single training or analysis pass. If more documents match, only this many are sampled, which bounds memory usage.
RETRAIN_INTERVAL	Integer	36000	60 – 2,592,000 seconds	Seconds between the end of one training run and the start of the next, for the L3/L4 detection models.

Volumetric DDoS sampling (TCP, UDP and ICMP time windows)

Setting	Type	Default	Accepted range	Purpose
DDOS_ALLOWED_LATENESS	Integer	12	0 – 3600 seconds	Number of seconds after a time window ends during which late-arriving flows from RabbitMQ are still added to it, for the TCP, UDP and ICMP detectors.
DDoS_TIME_WINDOW_SECONDS	Integer	60	1 – 86,400 seconds	Time window, in seconds, used to group traffic samples for volumetric DDoS detection.

LSTM models (DNS and NTP floods)

Setting	Type	Default	Accepted range	Purpose
LSTM_SEQUENCE_LENGTH_NTP	Integer	20	2 – 10,000 time steps	Number of consecutive time windows fed into the LSTM model in one input sequence, for the NTP-based DDoS detector.
LSTM_SEQUENCE_LENGTH_DNS	Integer	20	2 – 10,000 time steps	Number of consecutive time windows fed into the LSTM model in one input sequence, for the DNS-based DDoS detector.
LSTM_DDOS_CONTAMINATION_RATE	Float	0.007	0 – 0.5	Expected fraction of anomalous (attack) samples in the LSTM training data. 0.007 means the model assumes roughly 0.7% of training samples are attacks.
LSTM_TIME_WINDOW	Integer	60	1 – 86,400 seconds	Length, in seconds, of the time windows built for the DNS and NTP LSTM detectors.
LSTM_ALLOWED_LATENESS	Integer	10	0 – 3600 seconds	Number of seconds after a time window ends during which late-arriving flows from RabbitMQ are still added to it, for the DNS and NTP detectors.

Isolation Forest (TCP, UDP and ICMP floods)

Setting	Type	Default	Accepted range	Purpose
IFOREST_MIN_TRAIN_SAMPLES	Integer	500	10 – 10,000,000 samples	Minimum number of time-window aggregations required before the models can be trained. With fewer samples, training is skipped until enough data accumulates, which keeps false positives down.
IFOREST_DDOS_CONTAMINATION_RATE	Float	0.006	0 – 0.5	Expected fraction of anomalous (attack) samples in the Isolation Forest training data (TCP SYN/ACK/RST, UDP and ICMP models).

Robust Z-Score

Setting	Type	Default	Accepted range	Purpose
ZSCORE_LOG_SCALE	Integer (0 or 1)	1	`0` or `1`	`1` appends log-scaled values to the sliding windows (reduces the effect of very large spikes); `0` uses raw values. The edit dialog shows only the default (Default: 1) for this setting.
ZSCORE_SLIDING_WINDOW_LENGTH	Integer	60	2 – 1,000,000 observations	Number of most recent time-window aggregations kept in the sliding window used to compute the normal baseline.
ZSCORE_THRESHOLD_DNS	Float	7.0	1 – 100 (robust z-score, σ)	Z-Score above which a DNS time-window aggregation is flagged as anomalous.
ZSCORE_THRESHOLD_NTP	Float	7.0	1 – 100 (robust z-score, σ)	Z-Score above which an NTP time-window aggregation is flagged as anomalous.
ZSCORE_THRESHOLD_ICMP	Float	7.0	1 – 100 (robust z-score, σ)	Z-Score above which an ICMP time-window aggregation is flagged as anomalous.
ZSCORE_THRESHOLD_UDP	Float	7.0	1 – 100 (robust z-score, σ)	Z-Score above which a UDP time-window aggregation is flagged as anomalous.
ZSCORE_THRESHOLD_TCP_SYN	Float	7.0	1 – 100 (robust z-score, σ)	Z-Score above which a TCP SYN time-window aggregation is flagged as anomalous.
ZSCORE_THRESHOLD_TCP_ACK	Float	6.5	1 – 100 (robust z-score, σ)	Z-Score above which a TCP ACK time-window aggregation is flagged as anomalous.
ZSCORE_THRESHOLD_TCP_RST	Float	7.0	1 – 100 (robust z-score, σ)	Z-Score above which a TCP RST time-window aggregation is flagged as anomalous.

Attacker detection

Setting	Type	Default	Accepted range	Purpose
ATTACKER_DETECTION_CONTRIBUTION_THR	Float	0.8	0 – 1	Threshold on the cumulative sum of contributions (sorted in decreasing order) used to flag the source IPs that contribute most to the attack-specific features.
ATTACKER_DETECTION_SCORE_THR	Float	0.8	0 – 1	Proportion of source IPs with the highest anomaly scores that are flagged in the attacker-detection stage.

Layer 7 volume detector (HTTP flood)

Learns the normal request volume (with Prophet) and flags anomalies in the number of HTTP requests per second.

Setting	Type	Default	Accepted range	Purpose
L7_VOLUME_HISTORY_LENGTH_DAYS	Integer	3	1 – 90 days	Days of traffic-volume history used for training. Larger values slow down training.
L7_HISTORY_WINDOW_LENGTH	Integer	30	1 – 3600 seconds	Length, in seconds, of the window used when building the training history. Ideally equal to the analysis time window.
L7_VOLUME_TIME_WINDOW	Integer	30	1 – 3600 seconds	Analysis window of the volume detector, in seconds. Must be a positive whole number; a missing or invalid value falls back to the deployment’s value.
L7_VOLUME_DETECTOR_MAX_PREDICTION_MULTIPLIER	Float	1.0	0.1 – 100 (× forecast request-rate upper bound)	Multiplier on Prophet’s predicted upper bound: how many times the predicted maximum must be exceeded to raise an alarm.
L7_VOLUME_DETECTOR_THRESHOLD	Float	10.0	0 – 1,000,000 requests/s	Additive margin, in requests per second, accepted on top of the prediction. Prevents alarms on small perturbations for services whose predicted traffic is close to 0.
L7_VOLUME_RETRAIN_INTERVAL	Integer	1800	60 – 604,800 seconds	Seconds between retraining runs of all Layer 7 trainers (volume, compute and slow-attack). Long intervals save compute but can make the detectors slower to adapt to ramp-up attacks. At each retrain cycle the Layer 7 trainers also re-read the AI settings, so this interval also bounds how long a Layer 7 setting change takes to apply (see Notes).

Layer 7 compute detector (server load)

Learns the normal CPU load of the web server and flags anomalies between the observed and predicted load. When the threshold is exceeded, clients that use an unusually large share of resources are flagged as attackers.

Setting	Type	Default	Accepted range	Purpose
L7_COMPUTE_HISTORY_LENGTH_DAYS	Integer	3	1 – 90 days	Days of compute history used to build the normal baseline. Larger values slow down training.
L7_COMPUTE_MULTIPLIER	Float	3.0	0.1 – 20 (× forecast load upper bound)	Sensitivity multiplier applied to the predicted load.
L7_COMPUTE_THRESHOLD	Float	0.3	0 – 1000 (load average)	Additive threshold on the predicted load: how much extra load is allowed before an event is raised.
L7_COMPUTE_COST_SIGMA_MULTIPLIER	Float	4.0	0 – 20 standard deviations	How much compute a client must use to be flagged as an attacker, expressed in standard deviations from the normal per-IP load.
L7_COMPUTE_TIME_WINDOW	Integer	600	1 – 3600 seconds	Shown as L7 compute culprit window. How many seconds of recent web-server access logs the compute detector keeps and examines to find the clients responsible when a load anomaly is raised (600 = 10 minutes). Installations still on the old default of 30 were moved to 600 when they were upgraded; a value you set deliberately is kept.

Layer 7 slow-attack detector (slow connections)

Detects anomalies in the number of connections in the CONNECTING state. Slow attacks take longer to detect; there is a trade-off between accuracy and speed, especially for low-traffic services.

Setting	Type	Default	Accepted range	Purpose
L7_SLOW_TIME_WINDOW	Integer	30	1 – 3600 seconds	Length of each analysis window, in seconds. Longer windows are more robust but slower to detect. Traffic is analyzed each time a window completes.
L7_SLOW_ESTABLISHED_THRESHOLD_MULTIPLIER	Float	1.4	0.1 – 10 (× forecast upper bound)	Multiplier on Prophet’s predicted upper bound: how many times the predicted maximum must be exceeded to raise an alarm.
L7_SLOW_ESTABLISHED_THRESHOLD_MARGIN	Float	0.02	0 – 0.99 (fraction)	Absolute margin added to the threshold, as a fraction of connections. Prevents alarms on small perturbations for services with sporadic traffic.
L7_SLOW_HISTORY_LENGTH_DAYS	Integer	3	1 – 90 days	Days of HTTP flow history used to train the slow-attack detector. Larger values slow down training. Must be a positive whole number; a missing or invalid value falls back to the deployment’s value.
L7_SLOW_ANALYSIS_WINDOWS	Integer	13	1 – 1000 windows	Number of windows included in each analysis. More windows focus on long, sustained attacks; fewer windows detect short attacks but can produce more false positives.
L7_SLOW_SKIP_TIME	Integer	15	0 – 3600 seconds	Seconds of the most recent data excluded from analysis, because it may still be incomplete due to RabbitMQ lag. Larger values delay detection but make it more reliable.

Layer 7 oversized-header detector

Counts the Layer 7 error/warning log entries selected by Fluentd (typically requests with oversized headers). The count should normally be close to 0; a large value indicates an attack or a misconfigured server.

Setting	Type	Default	Accepted range	Purpose
L7_OVERSIZED_TIME_WINDOW	Integer	20	1 – 3600 seconds	Counting window of the oversized-header detector, in seconds. Must be a positive whole number; a missing or invalid value falls back to the deployment’s value.
L7_OVERSIZED_HEADER_THRESHOLD	Integer	4	1 – 1,000,000 events per window	Number of oversized-header messages within one L7_OVERSIZED_TIME_WINDOW that triggers an alert. This is an absolute count, not a rate, so if you change the window length, review this threshold too.

Editing a Setting

Find the setting you want to change (use the search field or open its group).
Click the edit button (pencil icon) in the Actions column. A dialog titled Edit Setting: followed by the setting name opens.

1 Dialog title – “Edit Setting:” and the setting name.
2 Description – the setting’s description, shown under the Value label.
3 Value field – a number field pre-filled with the current value. Integer settings accept whole numbers only; float settings accept decimals. The arrows step the value up or down.
4 Range hint – the accepted range with its unit and the factory default (for example, Accepted range: 1 to 365 days · Default: 7).
5 Close and Save buttons. Save is disabled while the field is empty.

Type the new value.
Click Save to apply the change, or click Close (or the × in the corner) to discard it.

After a successful save, a confirmation message appears, the dialog closes and the list refreshes with the new value.

Every AI setting shows a hint under the field. All settings except ZSCORE_LOG_SCALE show their accepted range, unit and default, including the Layer 7 detector settings, for example L7_COMPUTE_TIME_WINDOW:

ZSCORE_LOG_SCALE has no range, so its hint shows only the default (Default: 1).

Validation Rules

Values are checked twice. The number field refuses values outside the accepted range, and the server validates every update again before saving it. If the server rejects a value, the error is shown in red directly under the field, the dialog stays open, and nothing is changed.

Value Type	Rules
Integer	Must be a whole number, not less than -1.
Float	Must be a number (decimals allowed), not less than -1.
Setting-specific range	Settings with an accepted range in the reference tables above must also stay inside that range. Out-of-range values are rejected with a message naming the setting, the limit and the value you entered – for example, Days of training data must be at most 365 days (got 500).

All AI settings are integers or floats.

Notes

When changes apply. An AI setting change applies to the Layer 7 detectors at their next retrain cycle (at most L7_VOLUME_RETRAIN_INTERVAL seconds, default 1800, plus up to 30 seconds for the inference container to pick it up) and to the other detectors when their trainer next restarts (RETRAIN_INTERVAL, default 36000 seconds) and the inference container loads the newly trained model. Restarting the trainer and then the inference container applies it immediately; ask the administrator of the AI server if a change cannot wait.
Layer 7 windows and history. L7_VOLUME_TIME_WINDOW, L7_OVERSIZED_TIME_WINDOW, L7_SLOW_HISTORY_LENGTH_DAYS and L7_COMPUTE_TIME_WINDOW are used by their detectors. If a value is missing or is not a positive whole number, the detector falls back to the value set in the deployment configuration.
Settings cannot be created or deleted. The 42 AI settings are defined during installation. The page only lets you change their values.
Use caution with contamination rates. LSTM_DDOS_CONTAMINATION_RATE and IFOREST_DDOS_CONTAMINATION_RATE tell the models what share of the training data to treat as attacks. Too high a value can hide real attacks inside the learned baseline’s tolerance; too low a value can produce false positives.
Use caution with thresholds and window sizes. Lowering the ZSCORE_THRESHOLD_* values or shrinking time windows makes detection more sensitive and may increase false positives. Raising them makes it less sensitive and may miss smaller or shorter attacks.

Administration – overview of all administration categories.
Action Manager Settings – configure the automated response system that acts on detected attacks.
DSS Settings – configure the DSS detection engine thresholds.
Allowlist – manage IP addresses that should never be blocked.
Blocklist – view and manage currently blocked IP addresses.