Thwarting DoS Attacks: A Framework for Detection based on Collective Anomalies and Clustering