Behavior-based Clustering for Discrimination between Flash Crowds and DDoS Attacks

We propose discrimination methods that classify cluster of traffic behaviour of flash crowds and DDoS attacks such as traffic pattern and characteristics and check cluster randomness. The behavior-based clustering consolidates packet into clusters based on similarity of observed behavior, e.g., source IPs are clustered together based on their pattern of destination port usage. The main objectives are to find way to proactively resolve problems such as DDoS attacks by detection and resolving attacks in their early