DDoS Detection System: Utilizing Gradient Boosting Algorithm and Apache Spark

Distributed Denial of Service (DDoS) is one of the major threats to the Internet security. Various DDoS attacks have been reported against many organizations in recent years. There have been numerous studies investigating the effects of utilizing classification algorithms to detect and prevent DDoS attacks. However, the existing research has many obstacles including the achievement of practical performance rates of the detection system, the delay of detection, as well as the ability to deal with the large dataset. In this research, we propose a DDoS detection framework that mainly consists of Gradient Boosting classification algorithm (GBT) and the Apache Processing Engine Spark. Experimental results conducted in a Spark and Hadoop cluster, for evaluating the proposed framework regarding the performances as well as the delays using a real DDoS Dataset, show that the integration of the GBT algorithm with Apache Spark works excellently to detect DDoS attack. The volume of the dataset and the features space, as well as the depth of decision trees and number of iterations parameters, have a direct impact on the GBT algorithm performance rates and the delays.

I. Introduction

Distributed Denial of Service (DDoS) is one of the major threats to the Internet security as it has become more sophisticated to detect. The primary objective of such an attack is the prevention of an authorized access to resources. Alternatively, it exhausts the resource causing delays and disruptions to the operation.