Editing Denial-of-service attack (section)

===Application level key completion indicators===
Approaches to detection of DDoS attacks against cloud-based applications may be based on an application layer analysis, indicating whether incoming bulk traffic is legitimate.<ref>{{cite book |last1=Alqahtani |first1=S. |last2=Gamble |first2=R. F. |title=2015 48th Hawaii International Conference on System Sciences |chapter=DDoS Attacks in Service Clouds |date=1 January 2015 |pages=5331–5340 |doi=10.1109/HICSS.2015.627 |isbn=978-1-4799-7367-5 |s2cid=32238160}}</ref> These approaches mainly rely on an identified path of value inside the application and monitor the progress of requests on this path, through markers called ''key completion indicators''.<ref>{{cite news|last=Kousiouris|first=George|title=KEY COMPLETION INDICATORS:minimizing the effect of DoS attacks on elastic Cloud-based applications based on application-level markov chain checkpoints |newspaper=CLOSER Conference|date=2014|pages=622–628 |doi=10.5220/0004963006220628|isbn=978-989-758-019-2 }}</ref> In essence, these techniques are statistical methods of assessing the behavior of incoming requests to detect if something unusual or abnormal is going on. An analogy is to a brick-and-mortar department store where customers spend, on average, a known percentage of their time on different activities such as picking up items and examining them, putting them back, filling a basket, waiting to pay, paying, and leaving. If a mob of customers arrived in the store and spent all their time picking up items and putting them back, but never made any purchases, this could be flagged as unusual behavior.