Mining anomalies using traffic feature distributions
Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites