Systems, methods, and computer storage media for traffic segmentation in prevention of DDoS attacks are provided. Data associated with one or more users of a particular service or network is collected. Properties associated with the data are identified. In embodiments, the properties are shared with one or more related services. One or more requests are received for the service or related services. The legitimacy of the one or more requests is predicted.