Real-time DDoS attack detection system using big data approach

• Main Authors: Awan, Mazhar Javed, Farooq, Umar, Babar, Hafiz Muhammad Aqeel, Yasin, Awais, Nobanee, Haitham, Hussain, Muzammil, Hakeem, Owais, Mohd. Zain, Azlan
• Format: Article
• Language: English
• Published: MDPI 2021
• Subjects: QA75 Electronic computers. Computer science; T55-55.3 Industrial Safety. Industrial Accident Prevention
• Online Access: http://eprints.utm.my/id/eprint/94583/1/AzlanMohd2021_RealTimeDDoSAttackDetection.pdf; http://eprints.utm.my/id/eprint/94583/; http://dx.doi.org/10.3390/su131910743

Currently, the Distributed Denial of Service (DDoS) attack has become rampant, and shows up in various shapes and patterns, therefore it is not easy to detect and solve with previous solutions. Classification algorithms have been used in many studies and have aimed to detect and solve the DDoS attack. DDoS attacks are performed easily by using the weaknesses of networks and by generating requests for services for software. Real-time detection of DDoS attacks is difficult to detect and mitigate, but this solution holds significant value as these attacks can cause big issues. This paper addresses the prediction of application layer DDoS attacks in real-time with different machine learning models. We applied the two machine learning approaches Random Forest (RF) and Multi-Layer Perceptron (MLP) through the Scikit ML library and big data framework Spark ML library for the detection of Denial of Service (DoS) attacks. In addition to the detection of DoS attacks, we optimized the performance of the models by minimizing the prediction time as com-pared with other existing approaches using big data framework (Spark ML). We achieved a mean accuracy of 99.5% of the models both with and without big data approaches. However, in training and testing time, the big data approach outperforms the non-big data approach due to that the Spark computations in memory are in a distributed manner. The minimum average training and testing time in minutes was 14.08 and 0.04, respectively. Using a big data tool (Apache Spark), the maxi-mum intermediate training and testing time in minutes was 34.11 and 0.46, respectively, using a non-big data approach. We also achieved these results using the big data approach. We can detect an attack in real-time in few milliseconds.