  In specific conditions and crisis situations such as the pandemic of
coronavirus (SARS-CoV-2), or the COVID-19 disease, e-learning systems be-came
crucial for the smooth performing of teaching and other educational pro-cesses.
In such scenarios, the availability of e-learning ecosystem elements is further
highlighted. An indicator of the importance for securing the availability of
such an ecosystem is evident from the DDoS (Distributed Denial of Service)
attack on AAI@EduHr as a key authentication service for number of e-learning
users in Republic of Croatia. In doing so, numerous users
(teach-ers/students/administrators) were prevented from implementing and
participat-ing in the planned teaching process. Given that DDoS as an anomaly
of network traffic has been identified as one of the key threats to the
e-learning ecosystem in crisis scenarios, this research will focus on overview
of methodology for de-veloping a model for proactive detection of DDoS traffic.
The challenge in de-tection is to effectively differentiate the increased
traffic intensity and service requests caused by legitimate user activity
(flash crowd) from the illegitimate traffic caused by a DDoS attack. The DDoS
traffic detection model developed by following analyzed methodology would serve
as a basis for providing further guidelines and recommendations in the form of
response to events that may negatively affect the availability of e-learning
ecosystem elements such as DDoS attack.
