Clustering methods comparison: Application to source based detection of botclouds

Recently, cloud computing has conquered IT markets and majority of institutions use its services at different scales. As any IT technology, cloud computing suffers from security issues and numerous studies were - and in progress - given in order to overcome them. However, most of the latter focus on data, users and infrastructure security from external attacks, and very few ones focus on the issue of using the cloud's infrastructure as an attack tool or support. To address the issue of botnets hosted in the cloud, we realized an experimental campaign where we implemented a botnet on a virtualized infrastructure and realized numerous attacks. The collected data was exploited in order to study and compare the effectiveness of clustering methods in the detection of DDoS attacks generated by botnets in the cloud.