The　paper　proposes　to　apply　Empirical　Mode　Decomposition　(EMD)　to　network　traffic　signal.　Then　the　corresponding　intrinsic　mode　functions　(IMFs)　are　obtained　to　calculate　their　Hurst　index　based　on　which　the　influence　to　the　IMF　Hurst　after　DDoS　attack　was　analyzed.　Finally,　it　makes　a　judgment　on　whether　a　DDoS　attack　happened　or　not　by　solving　the　IMF　Hurst　index　of　the　unsure　sequence.　Experimental　results　show　that,　compared　with　the　original　signal　Hurst　index　assay,　this　method　can　increase　detection　precision　and　CI,　reduce　the　rate　of　false　positives　and　false　negative.　The　method　behaves　well　in　distinguishing　attacked　traffic　from　normal　ones.　©　2011　IEEE.