Low-Rate Application-Layer DDoS Attacks Detection by Principal Component Analysis (PCA) through User Browsing Behavior

摘要: Application-layer distributed denials of service (DDoS) attacks are becoming ever more challenging to internet service security, since firewall and intrusion detection system work on network layer while these attacks are launched on application layer. In contrast to prior work focusing on detection of high-rate DDoS attacks at static web sites, we propose a novel approach to detect low-rate application-layer DDoS attacks at dynamic web sites. A feature matrix is introduced to characterize user browsing behavior. Principal component analysis (PCA) is applied to profile the user browsing behavior pattern. Outliers from this pattern are used to identify anomaly users. Experiments are conducted to validate our approach. Experimental results show that our approach is accurate to detect low-rate application-layer DDoS attacks.