A new method of real-time distributed denial of service (DDOS) attack inspection is introduced, based on changes in the characteristic of network self-similarity. Using the real-time RS (R/sup 2/S) algorithm, simulation experiments with real DDOS attacks and background traffic have been carried out. The results show that DDOS attacks can be detected effectively and precisely under most situations using the proposed method.