Now we use average value for detecting ddos