A flash event (FE) is a large surge in traffic to a particular Web site causing a dramatic increase in server load and putting severe strain on the network links leading to the server, which results in considerable increase in network traffic. A denial of service attack (DoS) is an explicit attempt by attackers to prevent legitimate users of a service from using that service. Consider any attempt to undermine a Web site to be a denial of service attack.Network traffic anomaly detection can be done through the self-similar analysis of network traffic. In this case, the abnormal condition of network can be indicated by investigating the performance parameters of real time data locate at the acceptable ranges.A Denial of Service attack is an attempt by a person or a group of persons to cripple an online service. Distributed denial-of-service attacks (DDoS) pose an immense threat to the Internet users to keep endorsed users of a website or web service from accessing it, or limiting their ability to do so. DDOS attacks and flash events can both overload the server or the server’s Internet connection and result in partial or complete failure. If a DDOS attack or flash crowd attack occurs during a flash event, a Web server should aim to ignore DDOS requests and handle the legitimate requests. This requires the Web site to be able to identify two sets of requests and block both types of attacks. So overcome this problem introduce discrimination algorithm using the flow correlation coefficient as a similarity metric among suspicious flows.