Abstract:Distributed denial-of-service (DDoS) is a rapidly growing problem with the fast development of the Internet. There're multitude DDoS detection approaches, however, three major problems about DDoS attack detection appear in the big data environment. Firstly, to shorten the respond time of the DDoS attack detector, secondly, to reduce the required compute resources, and lastly, to achieve a high detection rate with low false alarm rate. In the paper, we propose an abnormal network flow feature sequence prediction approach which could fit to be used as a DDoS attack detector in the big data environment and solve aforementioned problems. We define a network flow abnormal index as PDRA with the percentage of old IP addresses, the increment of the new IP addresses, the ratio of new IP addresses to the old IP addresses and average accessing rate of each new IP address. We design an IP address database using sequential storage model which has a constant time complexity. The autoregressive integrated moving average (ARIMA) trending prediction module will be started if and only if the number of continuous PDRA sequence value, which all exceed an PDRA abnormal threshold (PAT), reaches a certain preset threshold. And then calculate the probability that is the percentage of forecasting PDRA sequence value which exceed the PAT. Finally we identify the DDoS attack based on the abnormal probability of the forecasting PDRA sequence. Both theorem and experiment show that the method we proposed can effectively reduce the compute resources consumption, identify DDoS attack at its initial stage with higher detection rate and lower false alarm rate.

DDoS Attack Detection Method Based on Network Abnormal Behaviour in Big Data Environment

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

An Abnormal Network Flow Feature Sequence Prediction Approach for DDoS Attacks Detection in Big Data Environment

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

DDoS Attack Detection Algorithm Using IP Address Features

An Abnormal Network Traffic Detection Algorithm Based on Big Data Analysis

Distributed denial of service attack detection based on IP Flow Interaction

DDoS Attack Detection Using IP Address Feature Interaction

DDoS Attack Detection Method Based on Linear Prediction Model

A Method of Run-Time Detecting Ddos Attacks

Group Testing Based Detection of Web Service DDoS Attackers.

DDoS Attack Detection Based on Random Forest

A Lightweight Ddos Flooding Attack Detection Algorithm Based On Synchronous Long Flows

DDoS Attacks Detection Model and Its Application

On the Detection of DDoS Attackers for Large-Scale Networks

A New Multistage Approach to Detect Subtle DDoS Attacks.

DDoS Attack Detection Based on Global Network Properties of Network Traffic Anomaly

DeepDDoS: Online DDoS Attack Detection

A fast all-packets-based DDoS attack detection approach based on network graph and graph kernel

Research on DDoS Attack Detection in Software Defined Network