Anomaly Detection for Application Layer User Browsing Behavior Based on Attributes and Features

摘要: Application layer distributed denial of service (App-DDoS) attacks has posed a great threat to the security Internet. Since these occur in application layer, they can easily evade traditional network and transport detection methods. In this paper, we extract group user behavior attributes from our intercept program instead web server logs construct feature matrix based on nine features characterize behavior. Subsequently, principal component analysis (PCA) is applied profile browsing pattern outliers are used recognize normal users attackers. Experiment results show that proposed method good distinguish Finally, implement three machine learning algorithms (K-means, DBSCAN SVM) further validate effectiveness features.