CORETECH

CoreDetection is a self-hosted DDoS detection and mitigation platform from CoreTech, designed for internet service providers, data centers, and enterprises. It analyzes NetFlow, sFlow, and IPFIX summaries from edge routers, while customer traffic remains on its normal network path. Running on the customer’s Linux infrastructure, the platform uses CoreML, an attack model trained on millions of DDoS records, to learn traffic patterns for each protected IP and /24. It identifies anomalies, scores potential attacks, and provides explanations and attack reports through an included dashboard.

When mitigation is enabled, CoreDetection can automate BGP remote triggered blackholing (RTBH) and FlowSpec responses, or use CoreEdge to scrub traffic. It targets the router where an attack enters, then checks whether the response is working and can widen mitigation if the flood continues. Features include alerts, customer-specific portal views, false-positive learning, and safeguards against acting on faulty flow data. CoreDetection is offered with documentation, installation guidance, and demo requests for organizations seeking control over DDoS detection and response on their own infrastructure.