An empirical evaluation of information metrics for low-rate and high-rate DDoS attack detection
Detecting botnet by anomalous traffic