A Novel Application Layer DDOS Detecting Method Based on Cluster Method

Application layer DDoS attack challenges web applications seriously. It launches attack by sending a large number of HTTP Get requests to a web server. The anomaly-based method is a promising method, which detects the DDoS attack by comparing the individual surfing behavior with a reference surfing-behavior profile. Yet due to the exist of noisy web logs caused by web-crawling, it is difficult to build robust reference profile for detection. This paper proposes a novel anomaly-based application DDoS detection scheme base on clustering method. Our method could tolerate the web-crawling traces in building reference surfing profile, and can detect different Application layer DDoS attack (e.g., repetitively getting several webpages, randomly getting webpages following hyper-links etc.). The simulation results show that our method can detect application layer DDoS attacks accurately.