LDDoS (Low-rate Distributed Denial of Service) attack is a new class of DDoS

which exploits TCP’s RTO (Retransmission Time Out) mechanism.An LDDoS attack can elude the monitor of traditional detection approach by sending low-rate packets in the way of periodic pulse to a victim.This paper proposes an approach of detecting LDDoS attack based on kalman filter.The error between one step prediction and the optimal estimation is used as the detection criterion.Experiments in simulation environment and practical network are conducted to test the detect performance and about 89.6% detect probability is achieved.Results show that this approach has an expected effect in detecting LDDoS attack.