使用Spark Streaming的自适应实时DDoS检测和防御技术  

Adaptive Technique for Real-Time DDoS Detection and Defense Using Spark Streaming

作　　者：方峰[1] 蔡志平[1] 肇启佳 林加润[1] 朱明[1] 

机构地区：[1]国防科学技术大学计算机学院,长沙410073

出　　处：《计算机科学与探索》2016年第5期601-611,共11页Journal of Frontiers of Computer Science and Technology

基　　金：国家自然科学基金 Nos.61379145;61363071~~

摘　　要：分布式拒绝服务(distributed denial of service,DDoS)攻击是重要的安全威胁,网络速度的不断提高给传统的检测方法带来了新的挑战。以Spark等为代表的大数据处理技术,给网络安全的高速检测带来了新的契机。提出了一种基于Spark Streaming框架的自适应实时DDoS检测防御技术,通过对滑动窗口内源簇进行分组,并根据与各分组内源簇比例的偏差统计,检测出DDoS攻击流量。通过感知合法的网络流量,实现了对DDoS攻击的自适应快速检测和有效响应。实验结果表明,该技术可极大地提升检测能力,为保障网络服务性能和安全检测的可扩展性提供了一种可行的解决方案。Distributed denial of service （DDoS） attack is an important security threat, the constant improvement of network speed to the traditional detection methods has brought new challenges. Represented by Spark and so on, the big data processing technology brings new opportunity to the completion of high-speed safety detection. This paper pro- poses an adaptive technique for real-time DDoS detection and defense using Spark Streaming framework. Based on source cluster grouping in sliding windows, and the deviation of proportionate to the source cluster of groups, this pa- per detects out the DDoS attack traffic trace, and realizes the adaptive rapid and precise detection of DDoS attacks through sensing legitimate network traffic. The experimental results show that the technique can greatly improve detec- tion capabilities, in order to ensure the security of network service performance and the extensibility of detection, this paper provides a feasible solution.

关 键 词：DDOS检测 DDOS防御 实时检测 自适应检测 SPARK STREAMING 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]