A method, network system and computer storage medium for DDoS defence in a packet-switched network are provided. The method is performed by a network system and includes: measuring a plurality of network parameters in incoming network traffic; ranking the plurality of measured network parameters based on machine learning; measuring a subset of the plurality of network parameters in incoming network traffic; determining an incoming network packet to be part of a DDoS attack or not by machine learning of the subset of the plurality of network parameters; and blocking an incoming network packet when the incoming network packet is determined to be part of a DDoS attack.