SSK-DDoS: distributed stream processing framework based classification system for DDoS attacks

Abstract

Distributed denial of service (DDoS) is an immense threat for Internet based-applications and their resources. It immediately floods the victim system by transmitting a large number of network packets, and due to this, the victim system resources become unavailable for legitimate users. Therefore, this attack is claimed to be a dangerous attack for Internet-based applications and their resources. Several security approaches have been proposed in the literature to protect Internet-based applications from this type of threat. However, the frequency and strength of DDoS attacks are increasing day-by-day. Further, most of the traditional and distributed processing frameworks-based DDoS attack detection systems analyzed network flows in offline batch processing. Hence, they failed to classify network flows in real-time. This paper proposes a novel Spark Streaming and Kafka-based distributed classification system, named by SSK-DDoS, for classifying different types of DDoS attacks and legitimate network flows. This classification approach is implemented using a distributed Spark MLlib machine learning algorithms on a Hadoop cluster and deployed on the Spark streaming platform to classify streams in real-time. The incoming streams consume by Kafka’s topic to perform preprocessing tasks such as extracting and formulating features for classifying them into seven groups: Benign, DDoS-DNS, DDoS-LDAP, DDoS-MSSQL, DDoS-NetBIOS, DDoS-UDP, and DDoS-SYN. Further, the SSK-DDoS classification system stores formulated features with their predicted class into the HDFS that will help to retrain the distributed classification approach using a new set of samples. The proposed SSK-DDoS classification system has been validated using the recent CICDDoS2019 dataset. The results show that the proposed SSK-DDoS efficiently classified network flows into seven classes and stored formulated features with the predicted value of each incoming network flow into HDFS.

K‐DDoS‐SDN: A distributed DDoS attacks detection approach for protecting SDN environment

“…F I G U R E 1 An illustration of performing DDoS attacks on Internet-based services or SDN. 9,10 F I G U R E 2 Distribution of country-wise DDoS attacks for Q2-2022 and Q3-2022. 12,13 Every nation has been floundering with the pandemic crisis from the first quarter of 2020, and therefore, people are started studying, serving, purchasing, playing etc., through online mode.…”

“…However, most of them deployed on the Hadoop cluster to protect the victim system or network in offline or batch processing mode. Few of them 5,9,10,42,43 deployed their proposed approach on DSPF for protecting the victim system or networks in real-time mode. However, the primary focus of these systems is to protect Internet-based services and failed to protect the SDN environment from large-scale DDoS attacks.…”

“…We characterize and compare the proposed K-DDoS-SDN with existing works. 5,9,10,27,28,[30][31][32][33][34][36][37][38][44][45][46][47]56 DSPF-based approaches, 5,9,10,[30][31][32]38,43,56 for DDoS attacks deployed on the Spark and Kafka framework. This type of mechanism analyzes network streams in micro-batch processing mode (near-to-live).…”

“…We characterize and compare the proposed K‐DDoS‐SDN with existing works 5,9,10,27,28,30‐34,36‐38,44‐47,56 …”

“…However, it will face a scalability problem when deployed on DSPF. Therefore, it is necessary to implement a detection approach using distributed ML/DL algorithms, such as Spark MLlib, H2O ML, BigDL, etc. Several existing DSPF‐based state‐of‐arts 5,9,10 systematically examined a massive number of raw packets on multiple nodes. Hence, it helps to distribute the workload of the detection mechanism. Several existing state‐of‐arts 27,28 are employed counter‐based detection methodologies to identify DDoS attacks.…”