in order to improve the security performance of multi-level residual network in the presence of DDoS attacks, a multi-level residual network DDoS attack detection method based on random forest is proposed. The random forest method is used to classify the multi-level residual network DDoS attacks, the Stirling approximation is used to obtain the entropy change rate, and the multi-level residual network DDoS attack detection is realized based on the comprehensive correlation of mutual information between features. The experimental results show that when using the improved method, the detection accuracy is 98.71%, the detection time is 36.87s, the stability is high, and has certain advantages.