Apache Hadoop Based Distributed Denial of Service Detection Framework

Abstract

Distributed Denial of Service (DDoS) attack is one of the most powerful and immense threats to internet-based services. It hinders the victim services within a short duration of time by overwhelming with the huge amount of attack traffic. A sophisticated attacker closely follows the current research of DDoS defense, perform a sophisticated attack by compromising millions of unsecured devices, and send a huge amount of attack traffic (Big Data) to destroy a victim. The attack volume size pattern is shifted to Terabits per second (Tbps) from Gigabits per second (Gbps). When a large amount of traffic is processed by the defense system to identify attack traffic, seldom defense system itself can become a victim of DDoS attack. Therefore, there is a demand to implement DDoS defense system which can efficiently process a massive amount of network traffic and immediately distinguish attack traffic. In this paper, we propose a victim-end Hadoop based DDoS defense framework to identify an attack using the MapReduce programming model based on information theory metric. Further, we have implemented Hadoop based DDoS testbed and validated proposed framework using real datasets, such as, MIT Lincoln LLDDoS1.0, CAIDA and live traffic generated using testbed. The experimental result of proposed framework shows higher detection accuracy (average detection accuracy is 97%).