DDoS attack detection method using cluster analysis
Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites