A PCA BASED FRAMEWORK FOR DETECTION OF APPLICATION LAYER DDoS ATTACKS

Hackers uses Distributed Denial of Service (DDoS) and leaves hundreds and thousands of bots to overwhelm the victim in terms of bandwidth and reduce the services that are rendering to the users. To initiate an attack against victim, hackers use the internet as their venue. To address this threat various methods were proposed, but all the earlier method identifies the DDoS attack that exists in IP and TCP layers. Attackers, on the other hand, found the vulnerabilities in the application-layer (higher layer) to attack the victim and using DDoS known as (App-DDoS) and makes complexity in finding and handling the attack. In this paper, in order to detect the attack in earlier stage that is targeted for the application layer, we proposed a framework. This framework uses the profiling of user’s browsing behavior and network traffic by sequence order independent and Principal Component Analysis (PCA) respectively. These profiles are clustered, and a threshold is used to verify and determine whether a HTTP request from a user is normal or abnormal. If the user request to the victim is normal, then it allows the access otherwise denies the request in the early stage itself. Finally, the proposed method is verified experimentally and confirmed with various types of App-DDoS attacks. KeywordsApp-DDoS, anomaly detection, user browsing behavior, network traffic, PCA, sequence order independent, clustering.