Abstract: After analyzing the detection algorithm of D-WARD, a representative source-end DDoS detection system, improved D-WARD with nonparametric recursive CUSUM algorithm. Meanwhile, by drawing on the experience of Load-Shedding in the load balance , used Kaufman algorithm to adjust and upgrade threshold value dynamically and compared their respective performance. Experiments proved that the improved system is lower in false-positive rate and false-negative rate, which is more accurate and could adapt to more complex network environments.