A distributed denial of service, DDOS, detection engine apparatus communicatively coupled to a plurality of web servers, the DDOS detection engine apparatus comprising: a web server interface configured to: receive a plurality of web log traces from a web server, the web server being one of the plurality of web servers; a first DDOS analysis engine apparatus configured to: extract a first feature vector from the plurality of web log traces, wherein the first feature vector is representative of network traffic on the plurality of web servers over a first period of time, said first feature vector including data representative of a set of data requests between requesting devices and said web servers; apply a clustering algorithm to the first feature vector to measure the concentration and/or dispersal of a distribution of data requests from requesting devices to said web servers; and a second DDOS analysis engine apparatus configured to: extract a second feature vector from the plurality of web log traces, wherein the second feature vector is representative of network traffic on the plurality of web servers over a second period of time, the second period of time greater than the first period of time, said second feature vector including data representative of a set of data requests between requesting devices and said web servers; and apply a machine learning technique to the second feature vector, in order to detect malicious web traffic; wherein the second DDOS analysis engine apparatus is further configured to receive a signal from said first DDOS analysis engine apparatus that network traffic has been categorized as malicious, and, in response thereto, to shorten a predetermined time window used for producing the second feature vector, and wherein said web server interface is further configured to communicate said detection of malicious web traffic to said web servers such that said web servers are configured to blacklist requesting devices responsible for said malicious web traffic. receive a plurality of web log traces from a web server, the web server being one of the plurality of web servers; a first DDOS analysis engine apparatus configured to: extract a first feature vector from the plurality of web log traces, wherein the first feature vector is representative of network traffic on the plurality of web servers over a first period of time, said first feature vector including data representative of a set of data requests between requesting devices and said web servers; apply a clustering algorithm to the first feature vector to measure the concentration and/or dispersal of a distribution of data requests from requesting devices to said web servers; and extract a first feature vector from the plurality of web log traces, wherein the first feature vector is representative of network traffic on the plurality of web servers over a first period of time, said first feature vector including data representative of a set of data requests between requesting devices and said web servers; apply a clustering algorithm to the first feature vector to measure the concentration and/or dispersal of a distribution of data requests from requesting devices to said web servers; and a second DDOS analysis engine apparatus configured to: extract a second feature vector from the plurality of web log traces, wherein the second feature vector is representative of network traffic on the plurality of web servers over a second period of time, the second period of time greater than the first period of time, said second feature vector including data representative of a set of data requests between requesting devices and said web servers; and apply a machine learning technique to the second feature vector, in order to detect malicious web traffic; wherein the second DDOS analysis engine apparatus is further configured to receive a signal from said first DDOS analysis engine apparatus that network traffic has been categorized as malicious, and, in response thereto, to shorten a predetermined time window used for producing the second feature vector, and wherein said web server interface is further configured to communicate said detection of malicious web traffic to said web servers such that said web servers are configured to blacklist requesting devices responsible for said malicious web traffic. extract a second feature vector from the plurality of web log traces, wherein the second feature vector is representative of network traffic on the plurality of web servers over a second period of time, the second period of time greater than the first period of time, said second feature vector including data representative of a set of data requests between requesting devices and said web servers; and apply a machine learning technique to the second feature vector, in order to detect malicious web traffic; wherein the second DDOS analysis engine apparatus is further configured to receive a signal from said first DDOS analysis engine apparatus that network traffic has been categorized as malicious, and, in response thereto, to shorten a predetermined time window used for producing the second feature vector, and wherein said web server interface is further configured to communicate said detection of malicious web traffic to said web servers such that said web servers are configured to blacklist requesting devices responsible for said malicious web traffic.