A method for detecting the sources of distributed denial of service attacks is disclosed. Control plane signaling data and user plane data is collected using network monitoring equipment connected to a communications network. The control plane signaling data and user plane data is correlated. Amounts of traffic are calculated for individual computing devices based on the correlated data. One or more computing devices are determined based on the amounts of traffic associated with the one or more computing devices satisfying a device anomaly criterion. A record including a list of the one or more computing devices is generated.