Real-Time DDoS Detection Based on Entropy Using Hadoop Framework

Sharma, Arushi; Agrawal, Charul; Singh, Aditya; Kumar, Krishan

doi:10.1007/978-981-32-9515-5_28

Cited by 9 publications

(13 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section, the primary purpose is to summarize existing DPF-based classification/detection approaches. In the literature, several researchers [27][28][29][30][32][33][34][35][36][37][38][39][40][41][42][43][44][45][46][47], proposed DPF-based classification approaches. Most of them are deployed on the Apache Hadoop [48,49] and stored data in HDFS [50].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

KS-DDoS: Kafka streams-based classification approach for DDoS attacks

2022

Self Cite

View full text Add to dashboard Cite

A distributed denial of service (DDoS) attack is the most destructive threat for internet-based systems and their resources. It stops the execution of victims by transferring large numbers of network traces. Due to this, legitimate users experience a delay while accessing internet-based systems and their resources. Even a short delay in responses leads to a massive financial loss. Numerous techniques have been proposed to protect internet-based systems from various kinds of DDoS attacks. However, the frequency and strength of attacks are increasing year-after-year. This paper proposes a novel Apache Kafka Streams-based distributed classification approach named KS-DDoS. For this classification approach, firstly, we design distributed classification models on the Hadoop cluster using highly scalable machine learning algorithms by fetching data from Hadoop distributed files system (HDFS). Secondly, we deploy an efficient distributed classification model on the Kafka Stream cluster to classify incoming network traces into nine classes in real-time. Further, this distributed classification approach stores highly discriminative features with predicted outcomes into HDFS for creating/updating models using a new set of instances. We implemented a distributed processing framework-based experimental environment to design, deploy, and validate the proposed classification approach for DDoS attacks. The results show that the proposed distributed KS-DDoS classification approach efficiently classifies incoming network traces with at least 80% classification accuracy.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Most of the DPF-based classification approaches [27,28,30,32,33,36,37,40,41,41] deployed on the Apache Hadoop framework. This type of system systematically stores and analyzes large numbers of network packets on a group of machines.…”

Section: Comparison With Existing Approachesmentioning

confidence: 99%

KS-DDoS: Kafka streams-based classification approach for DDoS attacks

2022

Self Cite

View full text Add to dashboard Cite

show abstract

“…Few authors 31‐43,91,92,95,96 proposed distributed framework‐based mechanisms and most of them deployed their mechanism on the Apache Hadoop. Apache Hadoop distributed framework follows a two‐step process to analyze data efficiently.…”

Section: Review Of Existing Distributed Processing Framework‐based Ddos Detection Systemmentioning

confidence: 99%

“…They validated the proposed system using the CAIDA, FIFA, MIT Lincoln datasets, and various scenarios of synthetic traffic flow. However, this system validated in an offline batch processing mode. Sharma et al 95 proposed an Apache Hadoop‐based DDoS detection system. They evaluated this system by designing a testbed (01 Namenode and 02 Datanodes) and generated real‐time traffic (ICMP) using several hosts.…”

Section: Review Of Existing Distributed Processing Framework‐based Ddos Detection Systemmentioning

confidence: 99%

“…The methodology behind 92,95 approach is to employ a Shannon Entropy to identify malicious flows. However, both systems 92,95 validated in an offline batch processing mode. Patil et al 91 proposed a Spark‐based victim‐end DDoS detection system called S‐DDoS to identify both high‐rate and low‐rate DDoS attacks. This system designed using a highly scalable H2O sparkling machine learning tool on the Hadoop framework.…”

Section: Review Of Existing Distributed Processing Framework‐based Ddos Detection Systemmentioning

confidence: 99%

See 1 more Smart Citation

Distributed frameworks for detecting distributed denial of service attacks: A comprehensive review, challenges and future directions

Patil

Krishna

Kumar

2021

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

A distributed denial of service (DDoS) attack is a significant threat to web‐based applications and hindering legitimate traffic (denies access to benign users) by overwhelming the victim system or its infrastructure (service, bandwidth, networking devices, etc.) with a large volume of attack traffic. It leads to a delay in responses or sometimes a crash victim system. Even a few moments of pause in web‐based applications lead to a huge monetary loss and a bad reputation in the market. Several approaches available in the literature to protect websites from different types of DDoS attacks. However, incidents and volume sizes of DDoS attacks are growing quarter by quarter. Further, various challenges in the traditional framework based defense mechanisms: itself becoming a victim of attacks while analyzing a massive amount of traffic, require more time for detection process, no coordination among the modules, etc. This paper presents a comprehensive DDoS defense deployment taxonomy and critically reviewed existing distributed frameworks based DDoS attack detection systems. Further, characterized several existing distributed processing frameworks to select an appropriate one for deploying DDoS attack detection mechanisms. Finally, several evaluation metrics, open issues, discussion on available datasets including their limitations, and future directions are presented.

show abstract

K‐DDoS‐SDN: A distributed DDoS attacks detection approach for protecting SDN environment

Kaur,

Krishna,

Patil

2023

Concurrency and Computation

View full text Add to dashboard Cite

SummarySoftware‐defined networking (SDN) is an advanced networking paradigm that decouples forwarding control logic from the data plane. Therefore, it provides a loosely‐coupled architecture between the control and data plane. This separation provides flexibility in the SDN environment for addressing any transformations. Further, it delivers a centralized way of managing networks due to control logic embedded in the SDN controller. However, this advanced networking paradigm has been facing several security issues, such as topology spoofing, exhausting bandwidth, flow table updating, and distributed denial of service (DDoS) attacks. A DDoS attack is one of the most powerful menaces to the SDN environment. Further, the central data controller of SDN becomes the primary target of DDoS attacks. In this article, we propose a Kafka‐based distributed DDoS attacks detection approach for protecting the SDN environment named K‐DDoS‐SDN. The K‐DDoS‐SDN consists of two modules: (i) Network traffic classification (NTClassification) module and (ii) Network traffic storage (NTStorage) module. The NTClassification module is the detection approach designed using scalable H2O ML techniques in a distributed manner and deployed an efficient model on the two‐nodes Kafka Streams cluster to classify incoming network traces in real‐time. The NTStorage module collects raw packets, network flows, and 21 essential attributes and then systematically stores them in the HDFS to re‐train existing models. The proposed K‐DDoS‐SDN designed and evaluated using the recent and publically available CICDDoS2019 dataset. The average classification accuracy of the proposed distributed K‐DDoS‐SDN for classifying network traces into legitimate and one of the most popular attacks, such as DDoS_UDP is 99.22%. Further, the outcomes demonstrate that proposed distributed K‐DDoS‐SDN classifies traffic traces into five categories with at least 81% classification accuracy.

show abstract

Real-Time DDoS Detection Based on Entropy Using Hadoop Framework

Cited by 9 publications

References 7 publications

KS-DDoS: Kafka streams-based classification approach for DDoS attacks

KS-DDoS: Kafka streams-based classification approach for DDoS attacks

Distributed frameworks for detecting distributed denial of service attacks: A comprehensive review, challenges and future directions

K‐DDoS‐SDN: A distributed DDoS attacks detection approach for protecting SDN environment

Contact Info

Product

Resources

About