A covariance analysis model for DDoS attack detection
Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites