Abstract. DDoS (Distributed Denial of Service) attack, with its simple, difficult to detect, destructive features, causes a huge threat to the network security. In this paper, we construct a DDoS attack detection system and propose a DDoS detection algorithm based on sliding window. The effect of sliding window with different sizes on the accuracy of results is discussed and an optimal value is chosen as model parameter. Besides, we extract the characteristics of traffic and experiments show these features are meaningful to detect whether DDoS attack happens. Finally we choose some of the features and get a uniform standard of judgment by preprocessing, transforming these features and setting rules. The experimental result shows that the proposed algorithm can effectively detect DDoS attacks in real time, and the accuracy rate is 93%.