One of capabilities of a malicious botnet is to perform a distributed denial of service (DDoS) attack. Attacks can be performed by various methods like volumetric flooding, slow HTTP attacks or TCP protocol misuse. A DNS amplification is an example of volumetric flooding that became popular recently. It is well