Hi Aleksandar, You may refer following link: http://arxiv.org/abs/1204.5590

It may help you.

In my opinion, DDoS features are pretty good to implement in  NS2. Key indicators for DDoS attacks deals with similar traffic sequences from different hosts to the same destination. The used time slot is optimised to do the attack as sychronised as possible.

Accordingly, the scripting in NS2 is simple. Define attack methods, which generate the pre-defined traffic. In a second step, define an individual event (or point in time), which starts the attacks from all "zombie" nodes in the simulation. Attack destination is also simple to define by a chosen node id.

All you need are some sufficient DDoS exploits... you can find some interesting information here:

http://www.exploit-db.com/dos/

Kind regards,

Matthias