E-Had: A distributed and collaborative detection framework for early detection of DDoS attacks

•A Hadoop based distributed detection framework called E-Had to detect DDoS attacks is proposed.•E-Had distribute computational and memory overheads to multiple mappers and reducers.•E-Had is robust as it can continue to work in case some of the mappers do not respond in time.•E-Had is implemented using HA-DDoS testbed consisting of 30 real systems.•E-Had has been validated using different attack scenarios of CAIDA and DDoSTB datasets.