The aim of this research is to determine those allowed EWMA values of traffic, so that when they are exceeded, it will be considered as the appearance of a statistical anomaly suspected to attack. In this sense, the choice of only local maximums for analysis can be accepted as logical, because the critical point of maximum value of aggregate traffic is in this way also included.