Detection of application layer DDoS attack with clustering and likelihood analysis

One of the attacks observed against HTTP protocol is HTTP-GET attack using sequences of requests to limit accessibility of webservers. This attack has been researched in this report, and a novel detection technique has been developed to tackle it. In general, the technique uses entropy-based clustering and application of likelihood analysis to distinguish among legitimate and attacking sequences. It has been presented that the introduced method allows for formation of recent patterns of behaviours observed at a webserver, that remain unknown to the attackers. In addition, empirical analysis shows stability of the clustering approach. Subsequently, likelihood of websession behaviour has been provided to measure anomaly of web sessions. The method performs reasonably well, regardless of browsing strategies and scope chosen by attackers.