Real-Time DDoS Attack Detection System Using Big Data Approach

Sustainability

Haitham Nobanee¹  Awais Yasin²  Muzammil Hussain³  Owais Hakeem³  Hafiz Muhammad Aqeel Babar⁴  Mazhar Javed Awan⁴  Umar Farooq⁴  Azlan Mohd Zain⁵ 

[1] College of Business, Abu Dhabi University, Abu Dhabi 59911, United Arab Emirates;Department of Computer Engineering, National University of Technology, Islamabad 44000, Pakistan;Department of Computer Science, University of Management and Technology, Lahore 54770, Pakistan;Department of Software Engineering, University of Management and Technology, Lahore 54770, Pakistan;UTM Big Data Centre, School of Computing, Universiti Teknologi Malaysia, Skudai Johor 81310, Malaysia;

关键词: DoS attack;    Apache Spark;    big data;    privacy;    sustainability;    machine learning;   

DOI  :  10.3390/su131910743

来源: DOAJ

【 摘 要 】

Currently, the Distributed Denial of Service (DDoS) attack has become rampant, and shows up in various shapes and patterns, therefore it is not easy to detect and solve with previous solutions. Classification algorithms have been used in many studies and have aimed to detect and solve the DDoS attack. DDoS attacks are performed easily by using the weaknesses of networks and by generating requests for services for software. Real-time detection of DDoS attacks is difficult to detect and mitigate, but this solution holds significant value as these attacks can cause big issues. This paper addresses the prediction of application layer DDoS attacks in real-time with different machine learning models. We applied the two machine learning approaches Random Forest (RF) and Multi-Layer Perceptron (MLP) through the Scikit ML library and big data framework Spark ML library for the detection of Denial of Service (DoS) attacks. In addition to the detection of DoS attacks, we optimized the performance of the models by minimizing the prediction time as compared with other existing approaches using big data framework (Spark ML). We achieved a mean accuracy of 99.5% of the models both with and without big data approaches. However, in training and testing time, the big data approach outperforms the non-big data approach due to that the Spark computations in memory are in a distributed manner. The minimum average training and testing time in minutes was 14.08 and 0.04, respectively. Using a big data tool (Apache Spark), the maximum intermediate training and testing time in minutes was 34.11 and 0.46, respectively, using a non-big data approach. We also achieved these results using the big data approach. We can detect an attack in real-time in few milliseconds.

【 授权许可】

Unknown