Table of Content

Open Access iconOpen Access

ARTICLE

An Abnormal Network Flow Feature Sequence Prediction Approach for DDoS Attacks Detection in Big Data Environment

Jieren Cheng1,2, Ruomeng Xu1,*, Xiangyan Tang1, Victor S. Sheng3, Canting Cai1

School of Information Science and Technology, Hainan University, 570228, Haikou, China .
State Key Laboratory of Marine Resource Utilization in South China Sea, 570228, Haikou, China .
Department of Computer Science, University of Central Arkansas, Conway, AR 72035, USA.

* Corresponding author: Ruomeng Xu. Email: email.

Computers, Materials & Continua 2018, 55(1), 95-119. https://doi.org/10.3970/cmc.2018.055.095

Abstract

Distributed denial-of-service (DDoS) is a rapidly growing problem with the fast development of the Internet. There are multitude DDoS detection approaches, however, three major problems about DDoS attack detection appear in the big data environment. Firstly, to shorten the respond time of the DDoS attack detector; secondly, to reduce the required compute resources; lastly, to achieve a high detection rate with low false alarm rate. In the paper, we propose an abnormal network flow feature sequence prediction approach which could fit to be used as a DDoS attack detector in the big data environment and solve aforementioned problems. We define a network flow abnormal index as PDRA with the percentage of old IP addresses, the increment of the new IP addresses, the ratio of new IP addresses to the old IP addresses and average accessing rate of each new IP address. We design an IP address database using sequential storage model which has a constant time complexity. The autoregressive integrated moving average (ARIMA) trending prediction module will be started if and only if the number of continuous PDRA sequence value, which all exceed an PDRA abnormal threshold (PAT), reaches a certain preset threshold. And then calculate the probability that is the percentage of forecasting PDRA sequence value which exceed the PAT. Finally we identify the DDoS attack based on the abnormal probability of the forecasting PDRA sequence. Both theorem and experiment show that the method we proposed can effectively reduce the compute resources consumption, identify DDoS attack at its initial stage with higher detection rate and lower false alarm rate.

Keywords


Cite This Article

APA Style
Cheng, J., Xu, R., Tang, X., Sheng, V.S., Cai, C. (2018). An abnormal network flow feature sequence prediction approach for ddos attacks detection in big data environment. Computers, Materials & Continua, 55(1), 95-119. https://doi.org/10.3970/cmc.2018.055.095
Vancouver Style
Cheng J, Xu R, Tang X, Sheng VS, Cai C. An abnormal network flow feature sequence prediction approach for ddos attacks detection in big data environment. Comput Mater Contin. 2018;55(1):95-119 https://doi.org/10.3970/cmc.2018.055.095
IEEE Style
J. Cheng, R. Xu, X. Tang, V.S. Sheng, and C. Cai "An Abnormal Network Flow Feature Sequence Prediction Approach for DDoS Attacks Detection in Big Data Environment," Comput. Mater. Contin., vol. 55, no. 1, pp. 95-119. 2018. https://doi.org/10.3970/cmc.2018.055.095



cc Copyright © 2018 The Author(s). Published by Tech Science Press.
This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
  • 3672

    View

  • 1969

    Download

  • 0

    Like

Share Link