基于Hadoop的云端异常流量检测与分析平台

Hadoop based anomaly flow detection and analysis platform of cloud computing

Hadoop系统作为一种开源的分布式云计算平台已获得广泛应用,但其云端易受到各种威胁和攻击,基于此,开发了一种基于Hadoop的云端异常流量检查与分析平台。首先,使用Mapper周期性地从所有存储流量信息的文件中提取流量的部分信息;然后,通过Reducer将异常流量提取并保存。通过对流量数据的存储、检测与分析可成功地检测出有威胁的攻击,从而保障云端的安全。由于本平台基于开源的Hadoop实现,因此成本较低;同时,基于Java语言实现,可成功移植于各种主流操作系统,具有广泛适用性。基于局域网进行监控试验,结果表明本平台可成功地检测出异常流量,并输出友好的用户界面。

Hadoop system is an open source distribute cloud computing and is applied to a lot of services, the servers is easi- ly attacked, based on that, an anomaly flow detection and analysis platform is developed based on the Hadoop system. Firstly, all the flow information is abstracted from all the files which store the flow information by Mapper period. Then, with Reducer, the anomaly flow information is abstracted and stored. By storing, detection and analysis of the flow data the attacks are detected and the security is protected. As the produced software platform is built based on Hadoop, the cost is very low. At the same time, based on Java language, the software can run on many operations. Experiments based on the real LAN show that the produced soft- ware can detect the anomaly ＂flow successfully and has a good GUI.