A low-rate denial of service (LDoS) attack behaves as a small signal in periodic pulses with low average rate, which hides in normal TCP traffic stealthily. LDoS attacks reduce link throughput and degrade QoS of a target. An approach of detecting LDoS attacks is proposed based on Duffing oscillator in chaos systems. The approach detects LDoS attacks by adopting the technology of digital signal processing (DSP), which takes an LDoS attack as a small signal and normal TCP traffic as background noise. Duffing oscillator is used to detect LDoS attacks in normal TCP traffic. Simulations show that the LDoS attacks can be detected through diagram of the chaotic state, and the period and pulse width of LDoS attacks can be estimated.