A Neural-Network Based DDoS Detection System Using Hadoop and HBase

This paper presents a detection system for theDistributed Denial of Service (DDoS) attack based on neuralnetwork, which is implemented in the Apache Hadoop clusterand the HBase system. While there are already manyapproaches for the DDoS detection, there are two mainchallenges: the learning capability of a DDoS detection systemand the ability to process a huge unstructured dataset. Themain contribution of this paper is to develop a DDoS detectionsystem with learning capability to adapt to new types of DDoSattacks and ability to store and analyze a huge unstructureddataset collected from network logs. Particularly, a neuralnetwork architecture is designed for the DDoS detectionsystem, and a list of training samples is developed to train theneural network. This approach is validated with a series ofgenerated datasets of different scenarios. It was shown that thesystem with the well-trained neural network is able to detectDDoS attacks efficiently and successfully.

I. Introduction

Distributed denial-of-service (DDoS) [1] attack has become a vital threat to Internet servers. The DDoS attack mainly drains the resources of website servers and stop legitimate customers or website users from accessing the servers. This type of attack may seem trivial on website with small load of traffic, but it is a big issue if it occurs, for example, on a stock trading website or an ecommerce website because one second delay may cause millions of dollars of losses. A variety of DDoS detection systems have been designed and implemented to detect DDoS attacks, but there are still challenges which need to be conquered.