One method for application layer DDoS detection using ant clustering
Xin Li · Computer Engineering and Applications Journal · 2011
A novel method using ant clustering to detect application layer Distributed Denial of Service(DDoS) attacks is presented.According to the difference between normal users’browsing patterns and abnormal ones,user sessions are extract- ed from the web logs of normal users and similarities between different sessions are calculated,an improved ant clustering algorithm is employed to generate an adaptive detecting model.This model can be used to detect whether the undetermined sessions are DDoS attacks or not.The experiment results show that this method can detect attacks effectively and has a good performance in adaptability.