Distributed Denial of Service (DDoS) attack is a rising problem with rapid Internet growth. Times and low detection rates in the existing DDoS occurrence finding processes introduce a technique of identification of DDoS attacks based on abnormal network output in a big data environment. The method filters network flow based on the characteristics of a flood attack, permitting only the network flows, thereby minimizing intrusion from the usual grid flow and the accuracy detection. To represent changes in ancient and newfangled IP addresses for the many-to-one system flows, we set the Network-Based Abnormal Activity in Large Data (NBAALD). Finally, the NBAALD -based real-time DDoS attack detection method is developed to recognize the irregular network flow states of DDoS attacks. The consequences show approach has an established finding rate, a low false alarm rate, and an absent amount compared to similar procedures