It is a critical problem to detect distributed denial service (DDoS) attack with low false positive and negative in Internet. However, precisely detecting DDoS attack is very difficult, because there isn’t an essential difference between attack flow and normal flow. Attack packets with spoofing source IP address, consuming out bandwidth and system resources of destination hosts, can’t build a two way connection with destination. From this view,a new conception to reflect the exception of network flow, One-Way Connection Density (OWCD), which can detect DDoS attack,was proposed. In order to understand the characters of OWCD series, the time series analysis of OWCD series was studied and the OWCD was used to detect DDoS. Experiments showed that OWCD series is a white noise series. It can not only detect DDoS attack, but also indicate attack intensity.
