Problem
Assume that one or some of the servers in your corporate network are under a Distributed Denial of Service (DDOS) attack. You would like to design a behavior-based rule in your Intrusion Detection and Prevention System (IDPS) to detect such attack.
a) What parameters will be useful to develop such rule?
b) Analyze the pros and cons of using an IDS over an IPS for detecting and reacting against DDOS attacks.