The entropy is used to represent the feature of DDoS, and the entropy is clustered by K-means algorithm. The threshold of DDoS detection is gotten from analyzing statistical normal network packets, then the normal characteristics training set is updated, and the DDoS is recognized on the basis of threshold. The experiments show that the measure can implement trainings and testing processes rapidly, and it can detect existence of DDoS effectively.