Abstract: An algorithm based on IPFIX network flow data is proposed. By using proposed algorithm, suspicious and abnormal DNS will be detected accurately, and DNS traffic amplification attack will be distinguished rapidly. This algorithm has been applied in the Tsinghua University campus network. In our practice, DNS abnormal behaviors have been detected and alarm information has been sent to administrators. Thus, abnormal attack behaviors are restrained in time, and the monitoring and warning for abnormal traffic are all realized.