Discriminating Flash Events from DDoS Attacks: A Comprehensive Review

Millions of people across the globe access Internet-based applications and web services in their day to day activities. Distributed Denial of Service (DDoS) attack is one of the prominent attacks that cripple down the computing and communication resources of a web server hosting these services and applications. The situation turns further crucial when DDoS attacks are launch during similar looking legitimate traffic called a flash event (FE). Both DDoS attacks and FEs causes a sudden surge in the network traffic leading to delay in the responses from the web server. It often leads to massive financial losses, and thus, require timely actions. This paper presents a comprehensive review that broadly discusses the DDoS and FE problem, and recapitulates the recently published strategies in this field. As part of the work, a pragmatic list of rationales to discriminate the two has been proposed. This list can help the researcher community for better understanding the problem and can provide more effective solutions to the ongoing problem of discriminating DDoS attacks from FEs.