\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Effective Detection and Prevention of Ddos based on Big Data-Mapreduce},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2015-01-15 (revised: 15 January 2015)}
\def\TheID{\makeatother }
\def\TheDate{2015-01-15}
\title{Effective Detection and Prevention of Ddos based on Big Data-Mapreduce}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Dr. Koppula Srinivas  Rao}

             \author[2]{Sumathi Rani  Manukonda}

             \affil[1]{  }

\renewcommand\Authands{ and }

\date{\small \em Received: 6 December 2014 Accepted: 3 January 2015 Published: 15 January 2015}

\maketitle


\begin{abstract}
        


Distributed Denial of Service (DDoS) attacks is large-scale cooperative attacks launched from a large number of compromised hosts called Zombies are a major threat to Internet services. As the serious damage caused by DDoS attacks increases, the rapid detection and the proper response mechanisms are urgent. However, existing security methodologies do not provide effective defense against these attacks, or the defense capability of some mechanisms is only limited to specific DDoS attacks. Therefore, keeping this problem in view author presents various significant areas where data mining techniques seem to be a strong candidate for detecting and preventing DDoS attack. The new proposed methodology can perform detecting and preventing DDoS attack using MapReduce concepts in Big Data.Thus the methodology can implement for both detecting and preventing methodologies.

\end{abstract}


\keywords{ddos attacks, data mining-big data, mapreduce .}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{EffectiveDetectionandPreventionofDdosbasedonBigDataMapreduce}]{EffectiveDetectionandPreventionofDdosbasedonBigDataMapreduce} 
\section[{Strictly as per the compliance and regulations of:}]{Strictly as per the compliance and regulations of:}\par
Sumathi Rani Manukonda ? \& Dr. Koppula Srinivas Rao ? I. introduction oday, the number of attacks against large computer systems or networks is growing at a rapid pace. One of the major threats to cyber security is Distributed Denial-of-Service (DDoS) attack .In which the victim network element(s) are bombarded with high volume of fictitious attacking packets originated from a large number of Zombies. In the modern computer world, maintaining the information is very difficult. Some interrupts may occur on the local system (attack) or network based systems (network attack). The aim of the attack is to overload the victim and render it incapable of performing normal transactions.In this paper a new cracking algorithm is implemented to stop that DDOS attacks. This is most critical attack for a network called distributed denial of service attack.To protect network servers, network routers and client hosts from becoming the handlers, Zombies and victims of distributed denial-of-service (DDoS) attacks data mining approach can be adopted as a sure shot weapon to these attacks. Without security measures and controls in place, our data might be subjected to an attack. In our algorithmic design a practical DDOS defense system that can protect the One common method of attack involves sending an enormous amount of request to the server or site and server will be unable to handle the requests and site will be offline for some days or some years depends upon the attack.\par
The proposed system identifies whether the number of entries of client exceeds more than five times to the same sever, then the client will be saved as a attacker in blocked list and the service could not be provided. So our algorithm protects legitimate traffic from a huge volume of DDOS traffic when an attack occurs.This approach uses the automatic feature selection mechanism for selecting the important attributes using the Map Reduce methodology. And the classifier is built with the theoretically selected attribute through the neural network. And then, our experimental results show that our approach can provide the best performance on the real network, in comparison with that by heuristic feature selection and any other single data mining approaches. 
\section[{II.}]{II.} 
\section[{Overview a) DDoS ATTACK}]{Overview a) DDoS ATTACK}\par
Distributed Denial-of-Service (DDoS) attack is the one in which the victim's network elements are bombarded with high volume of fictitious attacking packets that originate from a large number of machines.\par
In Recruiting phase attacker initiates the attack from the master computer and tries to find some slave computers to be involved in the attack. The number of DDoS attacks grew 20 \% last year -a major decrease in the rate of attacks from 2007 to 2008, when these devastating attacks increased 67 percent, according to a report.1 According to a report Internet Service Providers (ISPs) are most worried about botnet-driven distributed denial-of-service (DDoS) attacks2 .A small piece of software is installed on the Zombies to run the attacker commands. The Action phase continued through a command issued from the attacker resides on the master computer toward the Zombies computers to run their pieces of software. A successful attack allows the attacker to gain access to the victim's machine, allowing stealing of sensitive internal data and possibly cause disruption and denial of service (DoS) in some cases. The mission of the piece of software is to send dummy traffic designated toward the victim. Therefore, a mechanism that is strong and reliable is desired. Hence scale cooperative attacks launched from a large number of compromised hosts called Zombies are a major threat to Internet services. As the serious damage caused by DDoS attacks increases, the rapid detection and the proper response mechanisms are urgent. However, existing security methodologies do not provide effective defense against these attacks, or the defense capability of some mechanisms is only limited to specific DDoS attacks. Therefore, keeping this problem in view author presents various significant areas where data mining techniques seem to be a strong candidate for detecting and preventing DDoS attack. The new proposed methodology can perform detecting and preventing DDoS attack using MapReduce concepts in Big Data.Thus the methodology can implement for both detecting and preventing methodologies.\par
the key idea is to use data mining techniques to discover consistent and useful patterns of system features that describe program and user behavior of attack. 
\section[{III.}]{III.} 
\section[{Data Mining Data}]{Data Mining Data}\par
Data mining is becoming a persistent technology in activities as diverse as using historical data to predict the success of a marketing campaign, looking for patterns in network traffic to discover illegal activities or analyzing sequences. A data mining application is typically a software interface which interacts with a large database containing Network traffic parameters or other important data. From this outlook, the approach is gaining importance in the field of DDoS attacks. Data mining applications are computer software programs or packages that enable the extraction and identification of patterns from stored data. 
\section[{Figure : Architecture of DDoS attack}]{Figure : Architecture of DDoS attack}\par
Data mining is, at its core, pattern finding. Data miners are proficient at using specialized software to find regularity (and irregularities) in large \& complex data sets. Data mining is widely used by companies and public bodies for marketing, detection of fraudulent activities such as DDoS attacks. Huawei 2013 Security Research Report 29.81\% more DDoS attacks occurred than last year, More than 72.91\% attacks larger than 1Gbps. Http application protocols Attacked up to 87.74\% and Longest DDoS attacks last 349 hours 36 minutes 42 seconds. 
\section[{IV. Various Application Areas of Data Mining in Ddos Attacks}]{IV. Various Application Areas of Data Mining in Ddos Attacks}\par
Recently, data mining has become an important component for DDoS attack prevention. An overview of real time data mining-based intrusion detection systems (IDSs) is presented by researcher that focused on problems related to deploying a data mining-based IDS in a real time environment also discussed a distributed architecture for estimating cost-sensitive models in real time.\par
Different data mining approaches like classification, association rule, clustering, and outlier detection are the few techniques frequently used to analyze network traffic or data to gain knowledge that helps in controlling intrusion Various applications where data mining approach can be used in prevention and detection of DDoS attacks are discuss below:\par
V. 
\section[{Implementation a) Big Data-Map Reduce}]{Implementation a) Big Data-Map Reduce}\par
The average output of the map will be recorded ID as the key and retired as the value. Every mapper maintains a collection bearing the canopy center candidates it has learned thus far.\par
During every map the mapper determines if each successive record is within the distance threshold of any already determined canopy center candidate. The intermediate output sent to the reducer has the record ID as the cay and the list of retired-rating pairs as the value.\par
The yield of the reduce step will simply output record ID as the key and concatenate the rater IDs for that record into a comma separated list. The reducer repeats the same procedure as the mappers. It meets the candidate canopy center record IDs, but takes out those which are inside the same threshold limit . In other words, it removes duplicate candidates for the same canopy center. In order for this to operate correctly the number of reducers is set to one. commerce websites and web games, require a TCP connection between the zombie host and servers targeted for attack. To avoid detection, hackers reduce the attack traffic rate so that the attack footprint resembles a legitimate request. 
\section[{VI.}]{VI.}\par
Framework \& Algorithm\par
These heavy-traffic DDoS attacks are the easiest to detect, but require the highest processing performance to affect the necessary rapid response; otherwise, the network links will become jammed, completely flooded, while security devices deployed on the access side are failing. Until the recent arrival of cost-effective flow analysis technology, these superlarge-bandwidth DDoS attacks were best handled by commercial anti-DDoS SPs. Blocking such attacks requires the deployment of super-large capacity prevention systems on the upstream side of the network. Effective enterprise anti-DDoS systems must be based on high-performance hardware platforms with a minimum 100-Gbit/s defense capacity, or the defense device itself will likely become the network bottleneck. We have now entered the era where these high performance tools are now available for enterprises.\par
Because DDoS attack detection systems rely on traffic models for attack detection, the better the traffic model the higher the probability of detecting attacks. The difficulty in detecting light-traffic attacks is that the small numbers of attack packets are concealed in massive volume of legitimate network access packets. A further challenge to detecting low volume DDoS attacks is that application layer attacks strongly resemble legitimate access requests, and that even with increased sampling rates, flow analysis is unsuitable for detecting application layer attacks because QPS analytics are not included in the access traffic model. Mitigating this type of attack using traditional prevention systems can only limit the connections of legitimate access sources. 
\section[{a) DDoS Defense Technology Based on Big Data -Map}]{a) DDoS Defense Technology Based on Big Data -Map}\par
Reduce As an industry-leading anti-DDoS solutions provider, Huawei is the first vendor to apply Big Data technology to the detection and prevention of covert DDoS attacks disguised as normal access requests.\par
These heavy-traffic DDoS attacks are the easiest to detect, but require the highest processing performance to affect the necessary rapid response; otherwise, the network links will become jammed, completely flooded, while security devices deployed on the access side are failing. Until the recent arrival of cost-effective flow analysis technology, these superlarge-bandwidth DDoS attacks were best handled by commercial anti-DDoS SPs. Blocking such attacks requires the deployment of super-large capacity prevention systems on the upstream side of the network. Effective enterprise anti-DDoS systems must be based on high-performance hardware platforms with a minimum 100-Gbit/s defense capacity, or the defense device itself will likely become the network bottleneck. We have now entered the era where these high performance tools are now available for enterprises.\par
Because DDoS attack detection systems rely on traffic models for attack detection, the better the traffic model the higher the probability of detecting attacks. The difficulty in detecting light-traffic attacks is that the small numbers of attack packets are concealed in massive volume of legitimate network access packets. A further challenge to detecting low volume DDoS attacks is that application layer attacks strongly resemble legitimate access requests, and that even with increased sampling rates, flow analysis is unsuitable for detecting application layer attacks because QPS analytics are not included in the access traffic model. Mitigating this type of attack using traditional prevention systems can only limit the connections of legitimate access sources. 
\section[{b) DDoS Defense Technology Based on Big Data -Map}]{b) DDoS Defense Technology Based on Big Data -Map}\par
Reduce As an industry-leading anti-DDoS solutions provider, Huawei is the first vendor to apply Big Data technology to the detection and prevention of covert DDoS attacks disguised as normal access requests.  
\section[{Conclusion}]{Conclusion}\par
DDoS attacks are quite complex methods of attacking an ISP in large data. These attacks are an aggravation at a minimum, and if they are against a particular system, they can be brutally destroyed. This paper discussed various detection algorithms which are using data mining concepts \&algorithms for DDoS detection \& prevention. The proposed methodology we can detect the attack easily by implementing Map Reduce functionalities at the stage of verifying the Network IPs. Loss of network resources, costs money, delays work, and interrupts communication between various legal network users , thus it can prevent all these complexities effectively. Detecting, preventing, and mitigating DDoS attacks is important for national and individual security. But with the improvement in technology new areas are emerging where data mining techniques can be utilized for handling DDoS attacks that are to be discussed in future.\par
VIII.\begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{fig_0}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{:}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Figure :}\end{figure}
 			\footnote{© 2015 Global Journals Inc. (US) 1 © 2015 Global Journals Inc. (US) 1} 			\footnote{© 2015 Global Journals Inc. (US)} 			\footnote{© 2015 Global Journals Inc. (US) 1} 			\footnote{Effective Detection and Prevention of Ddos Based on Big Data-Mapreduce} 		 		\backmatter   			 
\subsection[{Acknowledgment}]{Acknowledgment}\par
We would like to thank everyone who has motivated and supported us for preparing this manuscript. 			  			 \par
These heavy-traffic DDoS attacks are the easiest to detect, but require the highest processing performance to affect the necessary rapid response; otherwise, the network links will become jammed, completely flooded, while security devices deployed on the access side are failing. Until the recent arrival of cost-effective flow analysis technology, these superlarge-bandwidth DDoS attacks were best handled by commercial anti-DDoS SPs. We have now entered the era where these high performance tools are now available for enterprises.\par
Because DDoS attack detection systems rely on traffic models for attack detection, the better the traffic model the higher the probability of detecting attacks. The difficulty in detecting light-traffic attacks is that the small numbers of attack packets are concealed in massive volume of legitimate network access packets. A further challenge to detecting low volume DDoS attacks is that application layer attacks strongly resemble legitimate access requests, and that even with increased sampling rates, flow analysis is unsuitable for detecting application layer attacks because QPS analytics are not included in the access traffic model. 
\subsection[{c) DDoS Defense Technology Based on Big Data -Map}]{c) DDoS Defense Technology Based on Big Data -Map}\par
Reduce As an industry-leading anti-DDoS solutions provider, Huawei is the first vendor to apply Big Data technology to the detection and prevention of covert DDoS attacks disguised as normal access requests. ? High security: The security solution must be able to defend against DDoS attacks of various types, regardless of the traffic attacks or application-layer attacks, to protect all online services from attacks. 
\subsection[{New algorithm using the Map Reduce Methodology}]{New algorithm using the Map Reduce Methodology}\par
? High performance: To avoid being the bottleneck of the whole system, the security solution must feature high-performance defense capabilities so that it can deal with the traffic flooding attacks on Tencent's large-scale services.\par
? High scalability: The security solution must support flexible performance expansion to vary with service requirement changes, catch up with service mode innovation, and form an architecture required for long-term service development, in order to protect previous investment and reduce total investment cost.. 
\subsection[{? High availability:}]{? High availability:}\par
The security solution must ensure reliable service connections, precisely differentiate attack traffic from normal traffic, and accurately identify attacks\par
? Low O\&M cost: Considering that O\&M cost significantly affects Tencent, the security solution must be small-sized, consume low power, minimize occupied equipment room space and consumption with improved performance, and greatly reduce the TCO for deploying multiple nodes in batches.			 			  				\begin{bibitemlist}{1}
\bibitem[Mirkovic and Reiher (2004)]{b0}\label{b0} 	 		‘A Taxonomy of DDoS Attack and DDoS Defense Mechanisms’.  		 			J Mirkovic 		,  		 			P Reiher 		.  	 	 		\textit{ACM SIGCOMM Computer Communications Review}  		April 2004. 34  (2)  p. .  	 
\bibitem[Aberrant Behavior Detection in Time Series for Network Monitoring Proc. of USENIX LISA ()]{b3}\label{b3} 	 		‘Aberrant Behavior Detection in Time Series for Network Monitoring’.  	 	 		\textit{Proc. of USENIX LISA},  				 (of USENIX LISA)  		2000.  	 
\bibitem[Salem et al. (2007)]{b7}\label{b7} 	 		‘An efficient online anomalies detection mechanism for highspeed networks’.  		 			O Salem 		,  		 			S Vaton 		,  		 			A Gravey 		.  	 	 		\textit{IEEE Workshop on Monitoring, Attack Detection and Migitation},  				MonAM 2007. November 2007.  	 
\bibitem[Dietrich et al. ()]{b8}\label{b8} 	 		‘Analyzing distributed denial of service attack tools: The shaft case’.  		 			S Dietrich 		,  		 			N Long 		,  		 			D Dittrich 		.  	 	 		\textit{Proceedings of 14th Systems Administration Conference},  				 (14th Systems Administration ConferenceNew Orleans, Louisiana, USA)  		2000. p. .  	 
\bibitem[Siris and Papagalou ()]{b4}\label{b4} 	 		‘Application of anomaly detection algorithms for detecting syn flooding attacks’.  		 			C Siris 		,  		 			F Papagalou 		.  	 	 		\textit{Proceedings of IEEE Global Telecommunications Conference (GLOBECOM '04)},  				 (IEEE Global Telecommunications Conference (GLOBECOM '04)Dallas, USA)  		2004. 4 p. .  	 
\bibitem[Douligeris and Mitrokotsa ()]{b5}\label{b5} 	 		‘DDoS attacks and defense mechanisms: classification and state ofthe-art’.  		 			A Douligeris 		,  		 			Mitrokotsa 		.  	 	 		\textit{Computer Networks}  		2004. 44  (5)  p. .  	 
\bibitem[Zhong et al. (2010)]{b1}\label{b1} 	 		‘DDoS Detection System Based on Data Mining’.  		 			Rui Zhong 		,  		 			Guangxue Yue ; Jinggangshan 		,  		 			P R China 		.  	 	 		\textit{) Proceedings of the Second International Symposium on Networking and Network Security (ISNNS '10)},  				2-4, April.2010. p. .  	 	 (Print) 
\bibitem[Kai et al. ()]{b6}\label{b6} 	 		‘Network Anomaly Detection Based on Statistical Approach and Time Series Analysis’.  		 			Huang Kai 		,  		 			Qi Zhengwei 		,  		 			Liu Bo 		.  	 	 		\textit{International Conference on Advanced Information Networking and Applications Workshops},  				2009.  	 
\bibitem[Lee et al. ()]{b9}\label{b9} 	 		‘Real Time Data Mining-based Intrusion Detection’.  		 			Wenke Lee 		,  		 			Salvatore J Stolfo 		,  		 			Philip K Chan Eleazar Eskin 		,  		 			Wei Fan 		,  		 			Shlomo Matthewmiller 		,  		 			Junxin Hershkop 		,  		 			Zhang 		.  	 	 		ieexlore. ieee.org  		2002.  	 
\bibitem[Bremler-Barr and Levy (2005)]{b2}\label{b2} 	 		‘Spooling prevention method’.  		 			H Bremler-Barr 		,  		 			Levy 		.  	 	 		\textit{Proc. IEEE INFOCOM},  				 			J Brutlag 		 (ed.)  		 (IEEE INFOCOMMiami, FL)  		March 2005.  	 
\end{bibitemlist}
 			 		 	 
\end{document}
