Flash crowd and malicious traffic including DoS and worm attacks present a real threat to the stability of internet networks. In this thesis we study the properties of both types of events with a special attention to characteristics that distinguish the flash crowd traffic from the attack traffic. In a result we proposed a mechanism to isolate the flash crowd traffic form DoS attack flowed in the Internet backbone. The proposed mechanism works with the global traffic control architecture which isolates network attacks from normal traffic in the backbone networks. In the global detection of the proposed mechanism IP-flow level detection is performed to distinguish the flash crowd traffic from DoS attack, later alert messages are generated and forwarded to the edge routers along with relative frequencies. Simulation result shows that the proposed mechanism is effective and it also increases the performance of the global traffic control architecture.
