A new relative entropy based app-DDoS detection method

Distributed Denial of Service (abbreviated DDoS) attack is a serious problem to the network services. This paper analyzed some solutions to the application layer DDoS (abbreviated app-DDoS) attack, and proposed a relative entropy based app-DDoS detection method. Our scheme includes two stages: learning stage and detection stage. Firstly at the learning stage, it extracts main click features of web objects with the cluster methods. Then at the detection stages, it computes the relative entropy for each session according to the learning result. The greater the session´s relative entropy, the more suspicious the session is. At last, simulation results suggest that this method can differentiate the attack session with high detection rate and low false negative ratio.