Abstract: Distributed Denial of Service (DDoS) attack traffic often is an unbearable burden on router,so a new DDoS attack detection method was proposed to release the burden and to detect the attack fast and accurately．In this method,traffic matrix between ports on the router is first constructed to precisely describe DDoS attack traffic aggregation cha-racteristics．Then Generalized Likelihood Ratio (GLR) statistical test is used to detect traffic anomaly after Kalman filter is applied to estimate traffic matrix．After that whether each router port is attacked by DDoS is judged．Finally,a simulation experiment with actual data was conducted to compare the method with PCA method,which shows that the proposed method has higher detection rate,lower false alarm rate and smaller detection lag time．

Key words: Distributed denial of service,Kalman filter,Anomaly detection,Traffic analysis,Traffic matrix