It will be a great feature to use fastnetmon DDoS detection which many people ask.
Website https://fastnetmon.com/
Git repo https://github.com/pavel-odintsov/fastnetmon
Already done simple xml with CLI by @Viacheslav and some python handler code
https://github.com/sever-sever/vyos-1x/commit/de5476157f8cc3a569cb7b2ee47585c5bf0fcb5a
https://github.com/DmitriyEshenko/vyos-1x/commit/2203e76cb593235894fe29705d9bcc663630851b
Commands example
```
set service ids fnm mode mirror
set service ids fnm listen-interface ethX
set service ids fnm network 10.0.0.0/24
set service ids fnm network 10.5.5.0/24
set service ids fnm direction input
set service ids fnm threshold fps 3500
set service ids fnm threshold pps 60000
set service ids fnm threshold mbps 300
set service ids fnm alert-script /tmp/alert.sh
```