Distributed denial of service (ddos) based accelerated solution

A method comprising:

• sampling, by network monitoring logic of each switch of a plurality of switches in a monitored data center, network packets to generate flow records representing behavior of network traffic;
• receiving, by a dataflow collector, the flow records from the plurality of switches;
• processing, by a streaming pipeline coupled to the dataflow collector, the flow records received from the dataflow collector;
• storing the flow records processed by the streaming pipeline in a data store;
• training, by a trainer accessing the flow records in the data store, one or more machine learning (ML) models to detect distributed denial of service (DDoS) attacks based on the flow records;
• and
• deploying at least one of the one or more ML models to at least one switch of the plurality of switches to determine whether a host device coupled to the at least one switch is subject to a DDoS attack.

A non-transitory computer-readable medium storing instructions that, when executed by a processing device, cause the processing device to:

• receive flow records from a plurality of switches in a monitored data center, each switch of the plurality of switches comprising network monitoring logic to sample network packets and generate the flow records representing behavior of network traffic;
• process the flow records using a streaming pipeline;
• store the flow records processed by the streaming pipeline in a data store;
• train one or more machine learning (ML) models to detect distributed denial of service (DDoS) attacks based on the flow records stored in the data store;
• and
• deploy at least one of the one or more ML models to at least one switch of the plurality of switches to determine whether a host device coupled to the at least one switch is subject to a DDoS attack.