Abstract:

Hybrid DDoS attack adopts the attack mode combining multiple data types, and gradually replaces the single type of DDoS attack because of its strong penetrating power and difficult to be accurately detected. For the detection of hybrid DDoS attacks, a distributed intrusion detection architecture based on Hadoop cluster is designed, and a multi-attribute fusion detection algorithm using MapReduce model is proposed. This algorithm improves the traditional algorithm which only detects from IP single angle, and can realize intrusion traffic detection by integrating IP, data frame length, flag bit and other multiple attributes and adaptive adjustment threshold. The experimental results show that the distributed intrusion detection system designed in this paper has good scalability, and better detection performance can be achieved by expanding the cluster scale and increasing the HDFS block size. Compared with the traditional detection algorithm, the detection rate of hybrid DDoS attack is significantly improved without significant increase in detection time, and the specific attack type can be determined.

Key words: hybrid DDoS attack, Hadoop, MapReduce, threshold, flag bit