基于用户浏览行为的HTTP Flood检测方法

与传统的基于低层协议的DDoS攻击相比,应用层DDoS具有更加显著的攻击效果,而且更加难以检测。现有的解决方法包括：特征检测、流量限制、隐半马尔可夫模型等。这些方法在检测应用层DDoS攻击（如,HTTP Get Flood）攻击时检测率不高或者检测速度较慢。提出的基于用户浏览行为的检测方法对HTTPFlood攻击检测效果明显得到改善。

The Http-flood Detection Methods Based on User Browsing Behavior

With the traditional DDoS attacks based on low-level protocol than the application layer DDoS attacks have a more pronounced effect, but also more difficult to detect. Existing solutions include: feature detection, traffic restrictions, hidden semi-Markov model. These methods in the detection of application layer DDoS attacks (eg, http-get flood) attack detection rate is low or the detection of slow. Presented in this paper based on user browsing behavior of the detection method of the http flood attack det...