A ddos ​​attack detection method in big data environment

Abstract

The invention relates to a method for detecting a DDoS (Distributed Denial of Service) attack in a big data environment. The method comprises the following steps: extracting a source IP address from various collected data streams, calculating information entropy of the source IP address, and if the information entropy is greater than a preset threshold value V, determining that the data stream corresponding to the IP address may be a DDoS attack stream, and implementing early warning; otherwise, determining that the data stream corresponding to the IP address is a normal data stream; training a dynamically-sampled K-Means model by using the normal data stream, and designing a dynamically-sampled K-Means parallelization algorithm based on a Spark stream processing technology; and detecting the data stream subjected to early warning by using the dynamically-sampled K-Means parallelization algorithm, and if a criterion function E of a detection result is smaller than or equal to a preset threshold value d, determining that the data stream is the DDoS attack stream, then blacklisting the source IP, and shielding the data stream. According to the method disclosed by the invention, various DDoS attacks in the big data environment can be effectively detected through early warning detection and abnormality confirmation detection, and thus the security of a system can be ensured.

Description

Technical field [0001] The invention relates to the field of network technology, in particular to a DDoS attack detection method in a big data environment. Background technique [0002] With the rapid development of the Internet and the general upgrade of ordinary user bandwidth, the bandwidth of home users has reached or exceeded 20M. In addition, with the popularization of 3G networks and the gradual promotion of 4G networks, the mobile Internet has also entered a period of vigorous development. The rapid growth of personal network bandwidth and the ever-increasing number of network users have caused an explosive growth of network data, and mankind has entered the era of big data. In the big data environment, more and more companies and enterprises are migrating their information technology infrastructure to cloud service providers to reduce costs, such as distributed storage data centers and various types of cloud computing systems. However, once these high-bandwidth network...

AI Technical Summary

Problems solved by technology

[0005] At present, the existing DDoS attack detection algorithms and systems use a single-machine processing method, which consumes a lot of time and cannot meet the actual needs of a big data environment with high bandwidth and a large number of user groups.

Images