An Intelligent and Time-Efficient DDoS Identification Framework for
  Real-Time Enterprise Networks SAD-F: Spark Based Anomaly Detection Framework
  Anomaly detection is a crucial step for preventing malicious activities in
the network and keeping resources available all the time for legitimate users.
It is noticed from various studies that classical anomaly detectors work well
with small and sampled data, but the chances of failures increase with
real-time (non-sampled data) traffic data. In this paper, we will be exploring
security analytic techniques for DDoS anomaly detection using different machine
learning techniques. In this paper, we are proposing a novel approach which
deals with real traffic as input to the system. Further, we study and compare
the performance factor of our proposed framework on three different testbeds
including normal commodity hardware, low-end system, and high-end system.
Hardware details of testbeds are discussed in the respective section. Further
in this paper, we investigate the performance of the classifiers in (near)
real-time detection of anomalies attacks. This study also focused on the
feature selection process that is as important for the anomaly detection
process as it is for general modeling problems. Several techniques have been
studied for feature selection and it is observed that proper feature selection
can increase performance in terms of model's execution time - which totally
depends upon the traffic file or traffic capturing process.
