DDoS attacks are measured in two primary ways. The first is
through the ATLAS system, which ties together global DDoS statistics measured
from backbone traffic. The second is through active botnet monitoring, watching
commands passed to the bots and distilling the attack information from that.
Both are needed to get a broader picture of DDoS activity, although neither one
is complete. It is also known, from measurements, that they are a disjointed
set of attacks, indicating that we are unable to track back the commands of all
DDoS attacks we observe on the Internet.