Application layer DDoS attacks are growing at alarming rate in terms of attackrnintensity and number of attack. Attackers target websites of governmentrnagencies as well as private business for diï¬€erent motives. One particular researchrnproblem is distinguishing Application layer DDoS attacks from ï¬‚ashrncrowds. Both ï¬‚ash crowds and application layer DDoS attack cause denial ofrnservice. Flash crowds come from sudden surge in traï¬ƒc of legitimate requests.rnWhereas, application layer DDoS attacks are intentionally generated by attackersrnto cause denial of service. Distinguishing between Application layerrnDDoS attacks and ï¬‚ash crowd is important because the action taken to addressrnboth problems is diï¬€erent. Flash crowds are legitimate requests whichrnshould be serviced. Whereas, Application layer DDoS attacks are maliciousrnrequests that should not be serviced. Furthermore, the source of applicationrnlayer DDoS attacks should be blocked from making further requests. In thisrnresearch, supervised machine learning based application layer DDoS detectionrnapproach was proposed to distinguish between application layer DDoSrnattack and ï¬‚ash crowd. Features that help distinguish application layer DDoSrnattacks from legitimate ï¬‚ash crowds were identiï¬ed. Six supervised classiï¬ersrnwere evaluated using World cup 98 ï¬‚ash crowd dataset and experimentallyrngenerated application layer DDoS attack dataset. We have selected decisionrntree as supervised classiï¬er in our detection system based on evaluation result.rnDecision tree had F1 score of 99.45% and False positive rate of 0.47%.