Discriminate flash crowd flows from DDoS attack is a hotspot and also, a tough and open problem for the IDS manufactures. Because DDoS attack flows possess higher similarity compared with that of flash crowd flows. The future challenges will be the investigation of the possibility of organizing a super botnet, which has a sufficiently large number of live bots to beat the current detection methods. Also, current detection strategies are known to attackers, they may develop new strategies to disable the detection. It is necessary to explore which actions should be taken to against attackers' actions.