I want to apply an algorithm on my Python script for HTTP flood attack detection. Main idea is to parse Apache logs to a MongoDB, but i want to extract only those lines that indicates an HTTP flood attack. Any idea please?
I would suggest using a tool that is geared towards log aggregation/parsing such as the ELK stack (Elastic search, Logstash and Kibana). After a couple of hours of research into the context and tools, you will be able to set up a logstash pipeline and a filter plugin that will suit your needs.
Parsing apache logs in particular is a very mature use case.
Regarding your specific question, some good generic starting points would be:
Detection of randomized subdomain requests ([gibberish].yourdomain.com), multiple and isolated requests targeted at a specific resource of your site (i.e an image, text file etc..) coming from random IPs, abuse of forms present on your site (multiple requests to your target script) or abusive entries in fields that traditionally have processing attached to them (uploads of malformed/large files).
Considering the context of your question, I would suggest basing my PoC on a specific common design flaw or popular package vulnerability in order to illustrate the detection techniques that might be relevant.
Perform the following search on google and it will yield DoS vulns that you can replicate and have working exploits that you can build countermeasure against: "apache dos site:exploit-db.com".