Detection of Application Layer DDoS Attacks with Clustering and Bayes Factors

One of the attacks observed against HTTP protocol is HTTP-GET attack using sequences of requests to limit accessibility of web servers. This attack has been researched in this report, and a novel detection technique has been developed to tackle it. In general, the technique uses entropy-based clustering and application of Bayes factors to distinguish among legitimate and attacking sequences. It has been presented that the introduced method allows for formation of recent patterns of behaviours observed at a web server, that remain unknown to the attackers. Subsequently, Bayes factors are introduced to measure anomaly of web sessions. The method performs reasonably well, against strategy and scope varying attackers.