In this paper we present the method of detecting of low-rate DDoS-attacks on the http-services. A low-rate attack model in the form of a chronological series of events with an additive superposition of attack and normal traffic is used. The task of developing a method of detection of low-rate attacks is formulated as allocation of homogeneous groups (patterns) of the time series, based on pattern recognition models, and the subsequent construction of prediction model for each separate group.

Keywords: intrusion detection; low-rate attacks; denial of service, artificial neural network; networks security, pattern recognition