Discriminating DDoS Attacks from Flash Crowds Using Flow Correlation Coefficient
Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites