Application-Layer DDoS Detection by K-means Algorithm
Chuyu She, Wushao Wen, Kesong Zheng, Yayun Lyu · 2016
Lots of methods have been proposed to detect Distributed Denial-of-Service (DDoS)attacks focus on the transport layer and the network layer.However, these methods may not work well when application-layer DDoS attack is launched.In this paper, we introduce a clustering method based on some features to detect application-layer DDoS attack.Firstly, we extract features from normal users' sessions.Then, we cluster users' sessions by K-means algorithm and build normal users' behavior model.Finally, we detect the application-layer DDoS attack based on the normal users' behavior model.