It will be a great feature to use fastnetmon DDoS detection which many people ask.
Website https://fastnetmon.com/
Git repo https://github.com/pavel-odintsov/fastnetmon
Already done simple xml with CLI by @Viacheslav and some python handler code
https://github.com/sever-sever/vyos-1x/commit/de5476157f8cc3a569cb7b2ee47585c5bf0fcb5a
https://github.com/DmitriyEshenko/vyos-1x/commit/2203e76cb593235894fe29705d9bcc663630851b
Commands example
```
set service ids fastnetmon mode mirror
set service ids fastnetmon listen-interface ethX
set service ids fastnetmon network 10.0.0.0/24
set service ids fastnetmon network 10.5.5.0/24
set service ids fastnetmon direction input
set service ids fastnetmon threshold fps 3500
set service ids fastnetmon threshold pps 60000
set service ids fastnetmon threshold mbps 300
set service ids fastnetmon alert-script /tmp/alert.sh
```