Design of distributed DDoS detection system

Abstract

We generated network flows from raw packets and extracted significant network traffic attributes. Further, formulated highly discriminative features based on extracted network traffic attributes for designing distributed classification models for DDoS attacks on the Hadoop cluster using highly scalable machine learning algorithms by fetching training and testing instances from Hadoop Distributed File System (HDFS). After that, deployed an efficient distributed classification model on the DSPF, such as Spark Streaming and Kafka streams to classify network flows in real-time and proof-of-concept implementation. The proposed system classified network flows into seven classes: Benign, DDoS-DNS, DDoS-LDAP, DDoS-MSSQL, DDoS-NetBIOS, DDoS-UDP, and DDoS-SYN in real-time. Finally, the testbed is designed based on various open-source DPF/DSPF to implement, deploy, and validate the proposed distributed DDoS attacks detection system. newline