A fixed threshold — "block anything over 500,000 packets per second" — catches attacks that look like what you configured it to catch. It has nothing to say about an attack that stays just under that number, or one that looks nothing like the pattern the threshold was tuned for. That gap is what AI-based detection is built to close.
Learning what "normal" actually looks like
Instead of a single static number, an AI detection engine builds a model of a network's typical traffic — volume, protocol mix, source diversity, timing patterns — across enough history to know what a normal Tuesday afternoon looks like versus a normal Sunday night.
Flagging deviation, not just volume
With that baseline established, the system can flag traffic that's statistically abnormal even when it never crosses a fixed pps or Gbps threshold — a sudden shift in protocol distribution, an unusual concentration of sources, or a pattern that simply doesn't resemble anything in the learned baseline.
Scoring, not just flagging
A useful detection system doesn't just say "suspicious" — it assigns a threat score, so an operator (or an automated response) can prioritize the handful of genuinely dangerous anomalies over the much larger number of minor statistical blips that don't warrant action.
Classifying the attack type
Beyond detecting that something is wrong, a mature system classifies what's happening — volumetric, protocol-based, application-layer, or a specific known pattern — which matters because the right mitigation response often depends on knowing which kind of attack is underway.
Retraining, and where humans still matter
Traffic patterns drift — new services launch, usage grows, seasonal patterns shift — so the baseline has to retrain periodically (commonly on a roughly 24-hour cycle) rather than staying fixed forever. And AI detection still benefits from human-configured guardrails: a whitelist for trusted IPs and monitoring systems keeps legitimate traffic from ever being flagged, regardless of how unusual the model finds it.
How eHAWK's AI engine works
eHAWK DDoS learns your network's normal traffic, flags statistical anomalies below simple thresholds, scores each event, classifies the likely attack type, and retrains automatically every 24 hours — one of three independent triggers, alongside threshold and threat-intelligence matching, that can flag an IP for blocking.