Detecting DDoS attack using MapReduce operations

Andrii Holovin


Denial of Service (DoS) and Distributed DoS (DDoS) attacks are evolving continuously. These attacks make network resources unavailable for legitimate users which results in massive loss of data, resources and money. Recent distributed denial-of-service (DDoS) attacks have demonstrated horrible destructive power by paralyzing web servers within short time. As the volume of Internet traffic rapidly grows up, the current DDoS detection technologies have met a new challenge that should efficiently deal with a huge amount of traffic within the affordable response time. This work focuses on novel DDoS detection method based on Hadoop that implements a HTTP GET flooding detection algorithm in MapReduce on the distributed computing platform.

Keywords: DDoS Attack, HTTP Flooding Attack, MapReduce, Apache Hadoop.


Lammel, R. (2008), Google’s MapReduce programming model – revisited, Science of Computer Programming, No. 70 (1), pp. 1-30.

Jie-Hao, C., Ming, Z., Feng-Jiao, C., An-Di, Z. (2012), DDoS defense system with test and neural network, Proceedings of the IEEE International Conference on Granular Computing (GrC), Hangzhou, China, pp. 38-43.

Li, J., Liu, Y., Gu, L. (2010), DDoS attack detection based on neural network, Proceedings of the 2nd International Symposium on Aware Computing (ISAC), Tainan, pp. 196-199.

Akilandeswari, V., Shalinie, S. (2012), Probabilistic neural network based attack traffic classification, Proceedings of the Fourth International Conference on Advanced Computing (ICoAC), Chennai, pp.1-8.

Siaterlis, C., Maglaris, V. (2005), Detecting incoming and outgoing DDoS attacks at the edge using a single set of network characteristics, Proceedings of the 10th IEEE Symposium on Computers and Communications (ISCC), Washington, pp. 469-475.

Shanmugam, B., Idris, N. (2009), Improved Intrusion Detection System using Fuzzy Logic for Detecting Anamoly and Misuse type of Attacks, Proceedings of the International Conference of Soft Computing and Pattern Recognition, Malacca, pp. 212-217.

DDoS Definitions – DdoSPedia, available at : (accessed 9 July 2015).

Zinchenko, V. V, Zinchenko, M. V (2012), Viyavlennya ddos-atak prikladnogo rivnya [Detection of application layer DDoS attacks], Mizhnarodna naukovo-tehnichna konferentsiya «RadIotehnichni polya, signali, aparati ta sistemi», Kyiv, pp. 262-264.

LOIC (Low Orbit Ion Cannon) : A network stress testing application, available at: (accessed 9 July 2015).

Scapy Project, available at : (accessed 19 August 2015).

Mausezahn, available at : (accessed 19 August 2015).

Iperf : network performance measurement tool, available at : (accessed 19 August 2015).

ISSN 2411-1031 (Print), ISSN 2518-1033 (Online)