<p>Distributed Denial of Service (DDoS) attacks pose a severe threat to network stability, and detecting them remains a significant challenge. Solutions based on programmable data planes and sketches have become a research hotspot. However, existing works, which are based on generic sketches, focus solely on the use of statistical results for large traffic flows, neglecting the inherent information within the large traffic itself. This could lead to additional costs for administrators in obtaining information about large traffic flows. To address this, we have designed a Multi-Level Sketch on the data plane to record detailed information of large flows and statistical information of small flows. In the control plane, we use the collected information to calculate the normalized entropy of the source IP addresses of network traffic, implementing an adaptive threshold detection scheme, a state control mechanism, and a traffic marking mechanism based on information from large flows. We validated the differences between Multi-Level Sketch and state-of-the-art methods on the public datasets CAIDA Anonymized Internet Traces 2019 and CAIDA DDoS 2007 using the same space size. The experimental results show that the average relative error difference between Multi-Level Sketch and Elastic Sketch is between 0.0383 and 2.82. In terms of information entropy estimation, the relative error of Multi-Level Sketch is 2.27 to 2.99 times lower than that of Elastic Sketch. In terms of true positive rate, false positive rate, and detection accuracy in DDoS attack detection, our method outperforms state-of-the-art methods.</p>