I have a high traffic web site.  

I want to create software which analyses client requests on-the-fly and decide if they come from a real user or a botnet bot. For training the neural network to identify legitimate ("good") users I can use logs when there are no DDoS activity. Once trained, the network would distinguish real users from bots.  

What I have:

* request URI (and order)
* cookie
* user agent
* request frequency.

Any ideas on how to best design ANN for this task and how to tune it?

Edit: [in response to comments about the overly broad scope of this question]

I currently have a working C# program which blocks clients on the basis the frequency of identical requests. Now I'd like to improve its "intelligence" with a classifier based on neural network.   

I don't know how to normalize these inputs for ANN and I need suggestions in this specific area.