A method and an attack detection function (200), for detection of a distributed attack in a wireless network (206) to which multiple wireless devices are connected via network nodes (210). It is checked whether characteristics of a traffic flow from each of a plurality of wireless devices (208) fulfil a predefined threshold condition related to abnormal traffic originating from the wireless devices, or not. When detecting that said characteristics of traffic flow fulfil the threshold condition, changes of the traffic flows from the wireless devices are identified, e.g. based on statistics on previous traffic originating from the wireless devices. It can then be determined whether the wireless devices are used in the distributed attack, based on said identified changes of the traffic flows.