NeonDDoS

NeonDDoS - Advanced DDoS Protection for Minecraft Servers
An enterprise-grade DDoS protection and traffic analysis system for your Minecraft server

Introduction
NeonDDoS is a comprehensive DDoS protection plugin designed specifically for Minecraft servers. It offers advanced detection algorithms, machine learning capabilities, and multiple protection methods to keep your server secure against various types of DDoS attacks.

Features
️ Comprehensive Protection

• Connection Monitoring: Detects and blocks suspicious connection patterns
• Advanced DDoS Detection: Sophisticated algorithms to identify various attack types
• Firewall Integration: Automatically blocks malicious IPs at the system level
• Traffic Prioritization: Ensures legitimate players maintain access during attacks

Machine Learning

• Anomaly Detection: Identifies unusual traffic patterns that may indicate attacks
• Attack Prediction: Forecasts potential attacks based on historical data
• Self-learning System: Continuously improves detection accuracy over time
• Adaptive Thresholds: Automatically tunes protection parameters

Advanced Filtering Options

• GeoIP Filtering: Block or allow traffic based on country of origin
• TCP Connection Filtering: Protect against SYN floods and protocol abuse
• IP Reputation System: Tracks and remembers malicious IPs

Analytics & Reporting

• Detailed Attack Analytics: Comprehensive data on attack patterns and sources
• Historical Statistics: Track trends and view attack history
• False Positive Management: Mark IPs as safe to prevent accidental blocks

Notification System

• Discord Integration: Real-time attack alerts via webhook
• In-game Notifications: Notifies admins when attacks are detected
• Email Alerts: Optional email notifications for critical events

Configuration
The config.yml file contains all configuration options:

# Connection threshold settings
connection:
  threshold: 10          # Maximum connections per timeWindow
  timeWindow: 10000      # Time window in milliseconds (10 seconds)
  blockDuration: 60000   # Block duration in milliseconds (60 seconds)

# DDoS Detection settings
detection:
  packetRateThreshold: 100         # Packets per second threshold
  connectionBurstThreshold: 5      # Connections per second threshold
  connectionPatternThreshold: 10   # Suspicious connection pattern threshold
  totalAttackScoreThreshold: 100   # Score threshold for attack detection
  analysisInterval: 30000          # Analysis interval in milliseconds

# Analytics settings
analytics:
  enableMachineLearning: true      # Enable machine learning analytics
  saveAnalyticsData: true          # Save analytics data to disk
  anomalyThreshold: 3              # Threshold for anomaly detection
  minDataPointsForAnalysis: 10     # Minimum data points before analysis
  patternMatchThreshold: 80        # Pattern matching threshold percentage

# Notification settings
notifications:
  ingame:
    enabled: true                  # Enable in-game notifications
    notificationLevel: 1           # 1=critical only, 2=important, 3=all
   
  discord:
    enabled: true                  # Enable Discord webhooks
    webhookUrl: "YOUR_WEBHOOK_URL" # Discord webhook URL
    username: "NeonDDoS Alert"     # Bot username
    avatarUrl: ""                  # Bot avatar URL
   
  email:
    enabled: false                 # Enable email notifications
    smtpHost: "smtp.example.com"   # SMTP server
    smtpPort: 587                  # SMTP port
    smtpAuth: true                 # Require authentication
    smtpStartTLS: true             # Use TLS
    username: "[email protected]"  # SMTP username
    password: "password"           # SMTP password
    from: "[email protected]"      # From address
    recipients: "[email protected]" # To address(es)

# Traffic prioritization settings
traffic-prioritization:
  enabled: true                    # Enable traffic prioritization
  dynamicBandwidthAllocation: true # Enable dynamic bandwidth allocation
  maxLowPriorityRequestsPerSecond: 20 # Max requests per second for low priority
  maxConnectionsPerSecond: 100     # Max total connections per second
  prioritySyncInterval: 5000       # Priority sync interval in milliseconds
  highLoadMode: balanced           # Mode during high load: strict/balanced/permissive
  minPlayerBandwidthPercent: 80    # Minimum bandwidth for verified players

# TCP filtering settings
tcp-filter:
  enabled: true                    # Enable TCP filtering
  maxSynPerSecond: 5               # Max SYN packets per second from one IP
  maxHalfOpenConnections: 20       # Max half-open connections per IP
  enableSynCookies: true           # Use SYN cookies for SYN flood mitigation

# GeoIP filtering settings
geoip:
  enabled: false                   # Enable GeoIP filtering
  whitelist-mode: false            # false = blacklist, true = whitelist
  database-path: ""                # Custom GeoIP database path

# Machine learning settings
machine-learning:
  enabled: true                    # Enable machine learning
  adaptiveThresholds: true         # Enable adaptive thresholds
  trainingIntervalMinutes: 30      # Training interval in minutes
  minDataPointsForTraining: 100    # Minimum data points for training
  detectionThreshold: 0.75         # ML detection threshold (0.0-1.0)
  modelSaveDirectory: "models"     # Directory to save ML models

Machine Learning System
NeonDDoS includes a sophisticated machine learning system that learns from attack patterns over time:

• The system automatically trains every 30 minutes (configurable)
• You can manually trigger training with /neonddos mltrain
• The ML system can detect attack patterns that traditional systems might miss
• It improves protection accuracy over time as it learns your server's normal traffic patterns

GeoIP Filtering
You can block or allow traffic from specific countries:

1. Enable GeoIP filtering in the config
2. Set whitelist-mode to true (only allow listed countries) or false (block listed countries)
3. Configure countries in the geoip.yml file that will be generated

Frequently Asked Questions
Q: Is this plugin compatible with BungeeCord/Velocity?
A: NeonDDoS is designed for standalone Spigot/Paper servers. For proxy protection, use a dedicated solution.

Q: Will this plugin affect server performance?
A: NeonDDoS is optimized to minimize performance impact during normal operation. It uses async processing for intensive operations and smart caching to maintain performance.

Q: How do I know if my server is being attacked?
A: NeonDDoS will send notifications (if configured) and you can check the attack statistics with /neonddos stats or detailed analytics with /neonddos analytics.

Q: How do I unblock an IP that was incorrectly blocked?
A: Use the /neonddos falsepositive <ip> command to mark it as a false positive and unblock it from the firewall.

Q: Does this plugin work with a dynamic IP address?
A: Yes, it tracks IPs individually and does not rely on your server's public IP for protection.

Future Updates
We're continually improving NeonDDoS with new features and enhancements. Stay tuned!