Discriminating DDoS Attacks from Flash Crowds Using Flow Correlation Coefficient
Your botnet is my botnet: analysis of a botnet takeover