Abstract: Aiming at the bottleneck problem of denial of service attack detection algorithm and processing speed, using denial of service attack log feature and improved variance algorithm in the paper，building a denial of service attack detection system on Hadoop and Flume，and use the distributed web log collection system of flume collect logs to HDFS，through research the distribution of abnormal behavior from statistical analysis of connection data and find characteristic of it, a Hadoop based statistical analysis model for denial of service attack detection is established, this paper puts forward the idea of improved variance to detect denial of service attack, making full use of distributed parallel computing ability of Hadoop, and it effectively improves the speed of detection and reduces the computation time.

Key words: Denial Of Service, Hadoop, Flume, Improved Variance, Flow statistics, MapReduce

摘要： 针对拒绝服务攻击检测算法和处理速度面临的瓶颈问题，基于利用拒绝服务攻击日志特征和改进方差算法，在Hadoop与Flume上构建拒绝服务攻击检测系统，运用Flume的分布式WEB日志采集系统收集日志至HDFS中，从连接数据的统计分析中寻找异常行为的分布规律，通过建立基于Hadoop的统计分析拒绝服务攻击检测模型，提出使用改进方差的思想来检测拒绝服务攻击，充分发挥Hadoop的分布式并行计算能力，有效提高了检测运算速度和减少了运算时间。

关键词: 拒绝服务攻击, Hadoop, Flume, 改进方差, 流量统计, MapReduce