DSS Settings

Overview

The DSS Settings page lets you configure the parameters used by the DDoS Detection System (DSS). The DSS is the DeDDoS component that analyzes network traffic, scores potential attacks, and decides when traffic levels warrant an alert or automated response.

Use this page to:

• Review the current DSS configuration, organized into four collapsible setting groups.
• Adjust the flood score levels that make the system more or less sensitive to traffic spikes.
• Tune the Exponential Moving Average (EMA) spans, rate-of-change threshold and exit ratio that smooth detection.
• Change how long the system waits before re-alerting on the same attack.
• Configure per-metric detection overrides for specific traffic types.

All settings on this page are predefined by the system. You can edit their values but cannot add or remove settings.

How to Open This Page

1. Click Administration in the top navigation bar.
2. Click the DSS tab (scatter chart icon) in the Administration tab strip.

The page opens at /administration/dss and the settings list loads automatically.

Permission required: Your account must belong to a group that has the Modify Settings or View Settings permission. With View Settings only, you can browse and search the list, but the edit buttons are replaced by a dash (—, “Read-only access”). If the DSS tab is not visible, ask your administrator to grant one of these permissions.

Main Areas

The page lists the 12 DSS parameters in four collapsible setting groups.

Click to enlarge

• 1 Administration tab strip – the DSS tab is highlighted. The other tabs lead to Users, Groups, Internal Networks, Allowlist, Blocklist, AI, Action Manager and Retention Policies.
• 2 Search field – filters the list by setting name or description. Click × or press Esc to clear it.
• 3 Expand all / Collapse all – open or close all four groups with one click (hidden while searching).
• 4 Group header – group name, number of settings and a chevron; click it to collapse or expand the group.
• 5 Name column – a question-mark help icon (hover or focus it for a short tip), the setting’s display label (for example Attack cooldown) and, underneath in small text, the internal setting name and its description. In the internal name, the DSS# database prefix is removed and underscores are shown as spaces, for example ATTACK COOLDOWN SECONDS.
• 6 Value column – the current value. Boolean settings show an Enabled or Disabled badge. SRC IP CONFIG shows “No per-metric overrides configured” while it is empty, or a collapsible JSON tree once it contains overrides. When the setting has a unit (for example seconds or score), the unit is shown under the value.
• 7 Edit button (pencil icon) – opens the Edit Setting dialog for that setting.

Setting Groups

Click a group header to collapse it. The collapsed/expanded arrangement is saved in your browser (local storage) for this page, so it is kept when you switch between administration sections or reload. While a search term is active, all matching settings are shown even if their group is collapsed.

Click to enlarge

JSON Viewer

When SRC_IP_CONFIG contains overrides, its value is shown as an interactive collapsible tree. Click the arrow next to an object key to expand or collapse that level. This lets you inspect the configuration without opening the edit dialog.

Settings Reference

The tables below list every DSS setting by group. Default is the value seeded at installation. Accepted range is enforced by the server when you save (see Validation Rules).

Flood thresholds

These settings define the traffic score levels at which the DSS raises warnings or triggers automated responses.

Detection smoothing

The DSS uses two Exponential Moving Averages to smooth traffic data and detect trends. The short EMA reacts faster to sudden changes; the long EMA captures the broader trend. When the short-term average diverges significantly from the long-term average, the system recognizes a potential attack.

Capture & processing

Attacker tracking

SRC_IP_CONFIG Structure

SRC_IP_CONFIG may contain only these two top-level keys (both optional):

• defaults – fallback thresholds applied to any metric that does not have its own entry in metrics.
• metrics – an object where each key is a traffic metric name (for example TCP_SYN, TCP_SYN_ACK, TCP_RST) and the value is a threshold object for that metric.

Each threshold object – in defaults or under a metric – may contain only these fields:

The server rejects a SRC_IP_CONFIG value with any other top-level key, an unknown field, a non-numeric threshold or a non-boolean enabled, and the error message names the offending key (for example, Unknown SRC_IP_CONFIG field “red” in “metrics.TCP_SYN”).

SRC_IP_CONFIG Example

The following example sets metric defaults and custom thresholds for TCP SYN traffic. The same example is shown under the editor in the edit dialog.

{
    "defaults": {
        "yellow_level": 50.0,
        "red_level": 200.0,
        "RoC_threshold": 30.0,
        "exit_ratio": 0.3,
        "ema_short": 5.0,
        "ema_long": 10.0,
        "enabled": true
    },
    "metrics": {
        "TCP_SYN": {
            "yellow_level": 25.0,
            "red_level": 80.0,
            "RoC_threshold": 20.0,
            "exit_ratio": 0.25,
            "ema_short": 5.0,
            "ema_long": 12.0,
            "enabled": true
        }
    }
}

In this example:

• All metric types use the defaults thresholds unless they have their own entry in metrics.
• TCP_SYN traffic uses a lower red level (80.0 instead of 200.0), making the system more sensitive to SYN flood patterns.
• You can add entries for other traffic types (for example TCP_SYN_ACK, TCP_RST) with the same structure.

Editing a Setting

1. Find the setting you want to change (search for it or open its group).
2. Click the Edit button (pencil icon) in the Actions column. A dialog titled Edit Setting: followed by the setting name opens.
3. The dialog contains the setting’s description and a Value field. A hint under the field shows the factory default for every setting; for number settings it also shows the accepted range and unit (for example, Accepted range: 1 to 86400 seconds · Default: 300). The input control depends on the data type:

Data Type	Input Control	Example
Integer	A number field that accepts whole numbers only (step of 1), limited to the accepted range.	Click to enlarge
Float	A number field that accepts decimal values, limited to the accepted range.	Same layout as integer, but accepts decimals.
Boolean	A toggle switch labeled Enabled or Disabled, with the default underneath in the same words (for example, Default: Disabled).	Click to enlarge
JSON	A code editor with syntax highlighting, line numbers and real-time validation; invalid JSON is flagged in the gutter and with an error message below the editor. The default is shown under the editor (for SRC_IP_CONFIG, Default: {}), followed for SRC_IP_CONFIG by a description of the expected structure and the example above.	Click to enlarge

4. Enter the new value and click Save, or click Close (or the × in the corner) to discard it. Save is disabled while a number field is empty.
5. If the update succeeds, a confirmation message appears, the dialog closes and the list refreshes with the new value.
6. If validation fails, the error message is shown in red under the field and the dialog stays open.

Validation Rules

The browser’s number fields refuse values outside the accepted range, and the server validates every update again before saving it:

• Integer values must be whole numbers, not less than -1, and inside the setting’s accepted range.
• Float values must be numeric, not less than -1, and inside the setting’s accepted range.
• Boolean values must be true or false.
• JSON values must be valid JSON. For SRC_IP_CONFIG, the value must also match the structure described above.

Out-of-range values are rejected with a message naming the setting, the limit and the value entered – for example, Exit threshold ratio must be at most 1 ratio (0-1) (got 1.5).

Notes

• Settings are predefined. You cannot add new settings or delete existing ones from this page. Only their values can be changed.
• Changes take effect on the next evaluation cycle. After you save a new value, the DSS picks it up on its next update. You do not need to restart any service.
• Threshold tuning requires care. Setting the yellow or red level too low causes frequent false alerts; setting them too high may delay detection of real attacks. Adjust thresholds incrementally and monitor the results on the Attacks and Notifications pages.
• EMA spans interact with each other. The short EMA span should always be less than the long EMA span. If they are equal, the crossover detection logic will not work correctly.
• Cooldown and exit ratio work together. The exit ratio decides when an attack is “over”, and the cooldown prevents immediate re-alerting. Shortening both makes the system more responsive but may produce duplicate alerts for a single prolonged attack.
• Per-metric overrides take precedence. When SRC_IP_CONFIG contains a threshold for a metric, that value is used instead of the corresponding global setting. The defaults section is the fallback for metrics not listed under metrics.
• Disable detection for a metric type. To stop the DSS from alerting on a specific traffic type, add an entry for that metric in SRC_IP_CONFIG with "enabled": false.

Related Pages

• Action Manager – Configure the automated response system that executes blocking actions when the DSS raises alerts.
• AI – Configure AI and machine-learning parameters that complement DSS detection.
• Attacks – View detailed records of detected attacks, including scores and timelines.
• Notifications – See the alert notifications generated when DSS thresholds are crossed.
• Internal Networks – Define the network ranges that the DSS monitors and protects.