One of the most dangerous attacks is Denial-of-Service (DoS). It’s a kind of volumetric attack. Proposed a framework to evaluate the network’s performance under this attack with various network parameters. Among all the network attacks, the Distributed Denial of service (DDoS) attack is easier to carry out, more harmful, hard to be traced and difficult to prevent. So, this threat is more serious. The DDoS attack makes use of many different sources to send a lot of useless packets to the target in a short time, which will consume the target’s resource and make the target’s service unavailable. The bots may be either themselves malicious users that have been preliminarily infected (e.g., worms and /or Trojans). In order to quantify the botnet learning ability in this work, Emulation Dictionary Rate (EDR) is introduced. Implemented a novel detecting algorithm for DDoS attacks based on IP Address Features Value (IAFV) to read the characteristics of the network based on time delay, throughput and packet delivery ratio. In the proposed system, a hybrid algorithm for botnet identification is implemented to analyze the network performance at the time of attack. Numerous relevant parameters including throughput, time delay and packet delivery ratio are evaluated. Using IAFV time series to describe the state change features of network flow and detecting DDoS attack is equivalent to classifying IAFV time series virtually. It has Support Vector Machine (SVM) classifier to get the optimal solution based on the existing information under the condition that the sample size tends to be infinite or be limited.