基于OC-SVM的Hadoop DDoS攻击检测  

Hadoop DDoS attack detection based on OC-SVM

作　　者：洪家军[1] 

机构地区：[1]莆田学院信息工程学院,福建莆田351100

出　　处：《河南城建学院学报》2014年第6期72-76,83,共6页Journal of Henan University of Urban Construction

基　　金：福建省教育厅国内访问学者资金资助项目;福建省中青年教师教育科研资助项目(A类)(JA14279)

摘　　要：DDoS以其攻击方法简单、破坏性强且难以追查等特点一直是互联网的主要威胁,而Hadoop作为云计算的主流平台,同样面临DDoS攻击的严重威胁。对此提出了一种基于One class SVM分类算法的Hadoop DDoS攻击分布式检测体系。该体系采用主动学习和疑似攻击核实机制,实时更新训练集,可以有效降低误报率和漏报率。实验结果表明,该体系有较好的分类准确性、较低的漏报率和误判率。DDoS has been a major threat to the Internet. It has the characteristics of simple attack method,destructiveness and untraceable. Research and application of cloud computing is being carried out. The Hadoop,as mainstream platform of cloud computing,faces the same serious threats of DDoS attack. Thus a new Hadoop DDoS distributed detection system based on one class SVM classification algorithm is proposed in this article.The mechanism of active learning and suspected attack verification are used in the new system,which can update the training set in real time,reduce the false positive rate and false negative rate effectively by using this method. It shows that the system has better classification accuracy,low false positive rate and false negative rate in experimental results.

关 键 词：HADOOP DDOS OC-SVM 自主学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]