KS-DDoS: Kafka streams-based classification approach for DDoS attacks

Abstract

A distributed denial of service (DDoS) attack is the most destructive threat for internet-based systems and their resources. It stops the execution of victims by transferring large numbers of network traces. Due to this, legitimate users experience a delay while accessing internet-based systems and their resources. Even a short delay in responses leads to a massive financial loss. Numerous techniques have been proposed to protect internet-based systems from various kinds of DDoS attacks. However, the frequency and strength of attacks are increasing year-after-year. This paper proposes a novel Apache Kafka Streams-based distributed classification approach named KS-DDoS. For this classification approach, firstly, we design distributed classification models on the Hadoop cluster using highly scalable machine learning algorithms by fetching data from Hadoop distributed files system (HDFS). Secondly, we deploy an efficient distributed classification model on the Kafka Stream cluster to classify incoming network traces into nine classes in real-time. Further, this distributed classification approach stores highly discriminative features with predicted outcomes into HDFS for creating/updating models using a new set of instances. We implemented a distributed processing framework-based experimental environment to design, deploy, and validate the proposed classification approach for DDoS attacks. The results show that the proposed distributed KS-DDoS classification approach efficiently classifies incoming network traces with at least 80% classification accuracy.

K‐DDoS‐SDN: A distributed DDoS attacks detection approach for protecting SDN environment

“…A DDoS attack is a significant menace for Internet-based systems, web services, devices (IoT and non-IoT), and traditional and modern types of networks, such as SDN. [5][6][7] The attackers send a massive amount of network traffic to the engaging resources of the victim. The impact of this type of attack can be victim networks or services down for a long time.…”

“…F I G U R E 1 An illustration of performing DDoS attacks on Internet-based services or SDN. 9,10 F I G U R E 2 Distribution of country-wise DDoS attacks for Q2-2022 and Q3-2022. 12,13 Every nation has been floundering with the pandemic crisis from the first quarter of 2020, and therefore, people are started studying, serving, purchasing, playing etc., through online mode.…”

“…However, most of them deployed on the Hadoop cluster to protect the victim system or network in offline or batch processing mode. Few of them 5,9,10,42,43 deployed their proposed approach on DSPF for protecting the victim system or networks in real-time mode. However, the primary focus of these systems is to protect Internet-based services and failed to protect the SDN environment from large-scale DDoS attacks.…”

“…We characterize and compare the proposed K-DDoS-SDN with existing works. 5,9,10,27,28,[30][31][32][33][34][36][37][38][44][45][46][47]56 DSPF-based approaches, 5,9,10,[30][31][32]38,43,56 for DDoS attacks deployed on the Spark and Kafka framework. This type of mechanism analyzes network streams in micro-batch processing mode (near-to-live).…”

“…However, it will face a scalability problem when deployed on DSPF. Therefore, it is necessary to implement a detection approach using distributed ML/DL algorithms, such as Spark MLlib, H2O ML, BigDL, etc. Several existing DSPF‐based state‐of‐arts 5,9,10 systematically examined a massive number of raw packets on multiple nodes. Hence, it helps to distribute the workload of the detection mechanism. Several existing state‐of‐arts 27,28 are employed counter‐based detection methodologies to identify DDoS attacks.…”