\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Detection and Counter Measure of AL-Ddos Attacksin Web Traffic},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2015-03-15 (revised: 15 March 2015)}
\def\TheID{\makeatother }
\def\TheDate{2015-03-15}
\title{Detection and Counter Measure of AL-Ddos Attacksin Web Traffic}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{  R.Sreenath}

             \author[2]{  E.S.Phalgunakrishna}

             \affil[1]{  SREE VIDYANIKETHAN ENGINEERING COLLEGE}

\renewcommand\Authands{ and }

\date{\small \em Received: 6 February 2015 Accepted: 3 March 2015 Published: 15 March 2015}

\maketitle


\begin{abstract}
        


Distributed Denial-of-Service (DDoS) assaults are a developing danger crosswise over Internet, disturbing access to Information and administrations. Presently days, these assaults are focusing on the application layer. Aggressors are utilizing systems that are exceptionally hard to recognize and relieve. In this task propose another technique to recognize AL-DDoS assaults. This work separates itself from past techniques by considering AL-DDoS assault location in overwhelming spine activity. In addition, the identification of AL-DDoS assaults is effectively deceived by glimmer group movement. By analyzing the entropy of AL-DDoS assaults and glimmer swarms, these model output be utilized to perceive the genuine AL-DDoS assaults. With a quick AL-DDoS identification speed, the channel is equipped for letting the real demands through yet the assault movement is halted.

\end{abstract}


\keywords{}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
Denial-of-Service (DoS) assault is an endeavor by aggressors to keep the true blue clients from utilizing the data administration. In a DDoS assault, these endeavors originate from an extensive number of circulated hosts that organize to surge the exploited person with a plenitude of assault bundles all the while. Conveyed foreswearing of-administration (DDoS) assaults present genuine dangers to servers in the Internet. DDoS assaults include in soaking the target machine with appeals, such that it can't react to authentic movement. Such assaults for the most part prompt a server over-burden.\par
To dispatch a DDoS assault, the aggressors first creates a system of bargained PCs that are utilized to produce the colossal volume of activity expected to refuse any assistance to honest to goodness clients of the victimized person. At that point the aggressor introduces assault apparatuses on the bargained hosts of the assault system. The hosts running these assault apparatuses are known as zombies, and they can be utilized to complete any assault under the control of the aggressor. The vast majority of the current procedures can't segregate the DDoS assaults from the surge of honest to goodness getting to.\par
These assaults are focusing on the application level. Application layer DDoS assaults may concentrate on debilitating the server assets, for example, Sockets, CPU, memory, circle/database data transmission, and I/O transfer speed. These assaults are normally more productive than TCP or UDP-based assaults, obliging less system associations with accomplish their malevolent purposes. They are likewise harder to distinguish, both on the grounds that they don't include a lot of activity and in light of the fact that they appear to be like ordinary kind movement. 
\section[{II.}]{II.} 
\section[{Rival Methods}]{Rival Methods}\par
? We have adopted a hidden semi-Markov process to present the behavior of Internet users .The hidden semi-Markov approach is a complex algorithm. When users visit a website, it traces and records the whole visiting history of each user. ? It is noticeable that the hidden semi-Markov method is unlikely to perform effectively in backbone traffic. ? Another typical approach against AL-DDoS attacks is to use CAPTCHA. This method requires users to recognize strings in a fuzzy picture and submit a response to a web server for authentication. However, users sometimes consider this operation as a negative experience to surf the Internet. ? The introduced wavelets to identify anomalies in network traffic. But wavelet analysis is generally a post-mortem analysis and cannot be used for online processing.\par
Previously proposedsignal analysis of network traffic anomalies mechanism to voluntarily increase the bandwidth utilization of legitimate users. However, this approach cannot reduce the network congestion and the load of web servers. A countermeasure that consisted of a suspicion assignment process and a DDoS-resilient scheduler.\par
The suspicion process assigns a continuous 'valued vs. binary' measure onto each client session. It further utilizes these values to determine if and when to schedule the requests of a session. However, this approach is still too time-consuming to detect AL-DDoS attacks in large volume traffic. 
\section[{III.}]{III.} 
\section[{Proposed System}]{Proposed System}\par
In this paper, we are motivated to design a defense system at the backbone level. This system is able to detect AL-DDoS attacks targeting Internet web servers. Currently, most of these web servers are deployed together in a data center connecting directly to the backbones. Thus, it is critical to implement an effective method to detect AL-DDoS attacks and filter the malicious traffic in backbones before they causes detriments to the web servers. The proposed system has low complexity and can real-timely run in high volume traffic.\par
One way to protect from DoS attacks is to allow only authorized clients to access the web server. Compared with non-attack cases, the number of requests in a session increases significantly in a very short time period in DDoS attack cases. Considering the above two issues, a hybrid approach for countering application layer DDoSatttacks is proposed. This approach gives priority to the good (legitimate) clients, while severely limiting the access to the attackers.\par
Each client is assigned with a trust value by the server based on the access behavior. A client's trust value is embedded in a HTTP cookie that is included in all server responses to the client. Using the cookie, a legitimate client can include the trust value in all its future requests to identify itself to the server. A client presenting a valid trust value to the server will be given the priority over other requests. New clients are assumed to be assigned with the lowest trust value by default by the server and updated in the response. The trust value varies according to the access pattern of the client. The trust values are assigned in such a way that trustattacker<trustnew user <trustlegitimate user In addition, the user's browsing behavior in multiple aspects is extracted from the system log during non-attack cases. Then the entropy of requests per session is calculated. Entropy is an information theoretical concept, which is a measure of randomness. The entropy is employed in this paper to measure changes of randomness of requests in a session for a given time interval. Entropy is applied as a second layer of filtering the suspicious flow. The second filtering mechanism is required to identify an attacker who acts like a legitimate client because, an attacker may behave benignly until it attains a highest trust value and then begin to misbehave.\par
The detection mechanism is deployed at the server. A session connection request first reaches the system, and then the proposed scheme either drops or forwards the requests based on the trust value obtained in the past session, calculates the entropy deviation of request rate. If the deviation is more (exceeds threshold), then drop the session immediately. Otherwise, schedule the session based on the system workload and the trust value of the user. The client who behaves better in past session will obtain higher degree of trust. The highest trust value first policy is used to schedule the requests for the server.\par
IV. 
\section[{Block Diagram}]{Block Diagram}\par
The above figure shows system architecture of the application. A session connection request first reaches the system, and then the proposed scheme either drops or forwards the requests based on the trust value obtained in the past session, calculates the entropy deviation of request rate. If the deviation is more (exceeds threshold), then drop the session immediately. Otherwise, schedule the session based on the system workload and the trust value of the user. The client who behaves better in past session will obtain higher degree of trust. The highest trust value first policy is used to schedule the requests for the server. Analogy The detection of DDoS attack is carried out as follows:\par
? Initially, the client embeds its trust value (Trust on the session request (rxy) and sends it to the server. ? The server, on receiving the session request, validates the trust value. ? If valid, it forwards the request (r ).\par
? Otherwise, the session is considered suspicious and dropped. ? Then the entropy (H(R)) for the incoming requests in a session is calculated and the degree of deviation with the predefined value is estimated. ? The greater the deviation, the more suspicious the session is. ? If the session is found suspicious, then it is assigned with the lowest trust value and dropped immediately. ? Otherwise, the requests are scheduled to get the service from the web server.  
\section[{a) Trust value computation}]{a) Trust value computation}\par
Once the request is accepted, the request is forwarded to the application. When the server sends a response to the client, it updates the trust value as follows:\par
Let req be the client's request and res be the corresponding response generated by the server. Let t rs be the time taken by the server to respond for the request req and ut denotes the utility of the request, req.\par
In this approach, a simple benefit function \hyperref[b1]{[2]} is used.\par
Where ? is a tunable parameter.\par
Here, additive increase multiplicative decrease strategy is used to calculate the new trust value.\par
If B(req) > 0, then the new trust value is computed as follows:Trust new = trustold + ? * B(req)?..(2)\par
Otherwise,Trust new = trust old /(?(1-B(req)))?.(3)\par
The additive increase ensures that the trust value slowly increases as the client behaves benignly; while the multiplicative decrease ensures that the trust value drops very quickly upon detecting a DoS attack from the client. 
\section[{b) Entropy calculation}]{b) Entropy calculation}\par
Let the request in a session be denoted as r xy , where x, y I, a set of positive integers. 'x' denotes the request number in session 'y'. Let |(r y ,t)| denote the number of requests per session y, at a given time t. Then, For a given interval Î?"t, the variation in the number of requests per session y is given as follows;\par
The probability of the requests per session y, is given by Let R be the random variable of the number of requests per session during the interval Î?"t, therefore, the entropy of requests per session is given as Based on the characteristics of entropy function, the upper and lower bound of the entropy H(R) is defined as 0 ? H(R) ? log N? \hyperref[b7]{(8)} where N is the number of the requests.\par
Under DoS attack, the number of request increases significantly and the following equation holds Where C is the maximum capacity of the session. 
\section[{c) Rate Limiter}]{c) Rate Limiter}\par
To avoid falsely detection, rate-limiter is introduced. Once the entropy is calculated, compute the degree of deviation from the predefined entropy. The system first sets a threshold for acceptable deviation. If the computed deviation exceeds the threshold, then the session is forced to terminate immediately. Otherwise, second level filter is applied by the rate limiter. The system also defines a threshold for validating a user based on the trust score. A user is considered to be legitimate only if the trust score exceeds the threshold. Otherwise, the user is considered malicious and the session is dropped immediately. The legitimate sessions are then passed to the scheduler for getting service from the server. 
\section[{d) Scheduler}]{d) Scheduler}\par
If the user is legitimate, then the scheduler schedules the session based on the highest trust value first (user with highest trust value) policy. The wellbehaved users will have a little or no deviation. In such case, the legitimate user gets a quicker service. In addition to the scheduling policy, system workload is also considered before scheduling the request for getting service. 
\section[{e) Algorithms}]{e) Algorithms}\par
Algorithm to compute the entropy from system log Input: system log 1. Extract the request arrivals for all sessions, page viewing time and the sequence of requested objects for each user from the system log. 2. Compute the entropy of the requests per session using the formula: a. Detection Algorithm Input the predefined entropy of requests per session.\par
Define the threshold for allowable deviation (Td) For each session waiting for detection Extract the trust value from the request Validate the trust value If the trust value issued is valid Extract the requests arrivals Compute the entropy for each session using \hyperref[b6]{(7)} Compute the degree of deviation   
\section[{Conclusion}]{Conclusion}\par
In this paper, an effective and efficient hybrid scheme against DDoS attacks based on trust value and information metric (entropy) is proposed. This approach not only counters the illegitimate flows but also avoids the flooding of the legitimate flows. Further is add detect trust value is used to detect the legitimate user from the attackers at the first level. Then, based on the information metric of the current session, the sessions that are assumed to be suspicious are dropped. The legitimate flows are then scheduled by the scheduler based on the system workload the trust value of the client. Thus the legitimate clients gets more priority in accessing the information and services.\begin{figure}[htbp]
\noindent\textbf{11}\includegraphics[]{image-2.png}
\caption{\label{fig_0}A 11 Global}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-3.png}
\caption{\label{fig_1}?}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-4.png}
\caption{\label{fig_2}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{}
\end{longtable} \par
 
\caption{\label{tab_0}Table 1 :}\end{figure}
 			\footnote{© 2015 Global Journals Inc. (US) 1} 			\footnote{© 2015 Global Journals Inc. (US)} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[D = |hnew (ed.)]{b10}\label{b10} 	 		\textit{},  		 			D = |hnew 		.  		R)| -|H(R)| (ed.)  		 	 
\bibitem[Devi and Yogesh (2012)]{b1}\label{b1} 	 		‘A Hybrid Approach to Counter Application Layer DDoS Attacks’.  		 			S Devi 		,  		 			P Yogesh 		.  	 	 		\textit{International Journal on Cryptography and Information Security (IJCIS)}  		June 2012. 2  (2) .  	 
\bibitem[Xie and Yu ()]{b3}\label{b3} 	 		‘A large-scale hidden semi-Markov model for anomaly Detectionon user browsing behaviors’.  		 			Y Xie 		,  		 			S Yu 		.  	 	 		\textit{IEEE/ACM Trans.Netw}  		2009. 17  (1)  p. .  	 
\bibitem[Barford et al. ()]{b6}\label{b6} 	 		‘A signal analysis of network traffic anomalies’.  		 			P Barford 		,  		 			J Kline 		,  		 			D Plonka 		,  		 			A Ron 		.  	 	 		\textit{Proceedings of the 2 nd ACMSIGCOMM Work shop on Internet Measurement},  				 (the 2 nd ACMSIGCOMM Work shop on Internet MeasurementNew York, NY, USA)  		2002. IMW' 02, ACM. p. .  	 
\bibitem[Kandula et al. ()]{b5}\label{b5} 	 		‘Botz-4-sale: surviving organized Ddos attacks that mimic flash crowds’.  		 			S Kandula 		,  		 			D Katabi 		,  		 			M Jacob 		,  		 			A Berger 		.  	 	 		\textit{Proceedings of the 2nd Conference On Symposiumon Networked Systems Design and Implementation," NSDI'05,USENIX Association},  				 (the 2nd Conference On Symposiumon Networked Systems Design and Implementation," NSDI'05,USENIX AssociationBerkeley, CA, USA)  		2005. p. .  	 
\bibitem[Von Ahn et al. ()]{b4}\label{b4} 	 		\textit{Captcha: using hardai problemsFor security},  		 			L Von Ahn 		,  		 			M Blum 		,  		 			N J Hopper 		,  		 			J Langford 		.  		2003. EUROCRYPT. p. .  	 
\bibitem[Walfish et al. ()]{b7}\label{b7} 	 		‘DDoS defense by offense’.  		 			M Walfish 		,  		 			M Vutukuru 		,  		 			H Balakrishnan 		,  		 			D Karger 		,  		 			S Shenker 		.  	 	 		\textit{ACM Trans. Comput. Syst}  		2010. 28  (1)  p. .  	 
\bibitem[Ranjan et al. ()]{b8}\label{b8} 	 		‘DDoS-resilient scheduling to counter application layer attacks under imperfect detection’.  		 			S Ranjan 		,  		 			R Swaminathan 		,  		 			M Uysal 		,  		 			E Knightly 		.  	 	 		\textit{Proceedings". INFOCOM 2006. 25th IEEE International Conference on Computer Communications},  				 (". INFOCOM 2006. 25th IEEE International Conference on Computer Communications)  		2006. p. .  	 
\bibitem[Zhou et al. ()]{b0}\label{b0} 	 		‘Detection and defense of application-layer DDoS attacks in backbone Web traffic’.  		 			Wei Zhou 		,  		 			Weijiajia 		,  		 			Yangxiang Shengwen 		,  		 			Wanlei Zhou 		.  	 	 		\textit{Future Generation Computer Systems}  		2014. 38 p. .  	 
\bibitem[Xie and Zhengyu ()]{b9}\label{b9} 	 		‘Monitoring the application-layer ddos attacks for popular websites’.  		 			Y Xie 		,  		 			S Zhengyu 		.  	 	 		\textit{IEEE/ACM Trans. Netw}  		2009. 17  (1)  p. .  	 
\bibitem[Arbor and Networks ()]{b2}\label{b2} 	 		\textit{Worldwide network infrastructure security report},  		 			Arbor 		,  		 			Networks 		.  		2011. Arbor Networks.  	 	 (Tech. Rep.) 
\end{bibitemlist}
 			 		 	 
\end{document}
