Detection and identification of neptune attacks and flash crowds

Abstract

Neptune attack and Flash Crowd are two typical threats to web servers. These two anomalies have many identical features that make them difficult to distinguish. In this paper, we propose a statistical packet-based method to detect Neptune attacks and Flash Crowds and more importantly, by performing separate analysis by source address aggregation, we also propose additional efficient means to differentiate these two similar anomalies. © Springer-Verlag Berlin Heidelberg 2007.