Techniques to Differentiate DDOS Attacks from Flash Crowd

Abstract

Flash crowds and DDOS attacks have very similar properties in terms of internet traffic. DDOS attacks are malicious requests that does not need to be handled by a server and flash crowd consist of legitimate requests, the server has responsibility to handle as many requests as possible during a flash event. So the attack flows are generated by the same pre built programs (attack tools), whereas the flash crowds come from the randomly distributed users all over the Internet. So in this paper, we aim to differentiate DDOS attack flows from flash crowds based on the following methods: Flow Correlation Coefficient, Packet Arrival Patterns, Information Distance and Probability Metrics.