HTTP DDoS Attack Detection Technology Based on PF-RING and Gaussian Naive Bayes in Containerized Environment
摘要
With the widespread adoption of container technology, modern enterprises increasingly utilize cloud-based deployments to enhance system flexibility and operational efficiency. However, this shift also introduces new security challenges, particularly HTTP Distributed Denial of Service (DDoS) attacks. These attacks mimic normal HTTP user behavior at the application layer, making them difficult for traditional defense mechanisms to detect, thus posing a significant threat to network security. To address this issue, this paper proposes an HTTP DDoS attack detection method that combines eBPF and PF_RING technologies and uses an optimized Gaussian Naive Bayes algorithm for efficient detection. The proposed method deploys efficient programs in kernel space for real-time analysis and feature extraction of network packets and uses PF_RING to optimize the network traffic capture process, reducing packet loss and system resource consumption. Experimental results demonstrate that this method outperforms traditional detection methods in terms of accuracy, recall, and F1 score, especially when handling large-scale data and real-time data streams. This approach not only enhances detection accuracy but also reduces system resource consumption, offering an optimized and efficient solution for HTTP DDoS attack detection in containerized environments.