Application Layer DDOS Attack Detection Using Hybrid Machine Learning Approach

Application Layer Distributed Denial of Service (App-DDoS) attack has become a major threat to web security. Attack detection is difficult as they mimic genuine user request. This paper proposes a clustering based correlation approach for detecting application layer DDoS attack on HTTP protocol. Proposed approach has two main modules ----Flow monitoring module and User behavior monitoring module. Flow monitor is responsible to analyze data flow information. User behavior monitor analyses end user behavior. Proposed approach is capable to detect three main attacks on HTTP protocol, i.e. HTTP-GET attack, HTTP-POST attack and Slow Read attack. It is also possible to detect hybrid type of DDoS attacks which uses a mixture network and application layer DDoS techniques. Comparative analysis of clustering algorithms on generated dataset is also done to demonstrate the effectiveness of detection approach.