Nowadays, distributed denial of service (DDoS) becomes a major challenge in the network as it affects the network at multi-level. This leads to traffic overhead and wastage of bandwidth utilisation. In order to overcome these issues, ant-based DDoS detection technique using roaming virtual honeypots is proposed. In this technique, virtual roaming honeypot along with the multi-level secure architecture is used to collect the information about the various intruders at different levels in the network. Ant colony optimisation technique is used to detect the intruders based on the pheromone deposit on that considered area. A multi-level IP log table is used to detect the intruders at different levels of the network. Once the affected area is found, the information is sent to multi-level architecture to limit the spread of the affected area to the honeypot. This information is sent to the honeypot to make a defence system against the attackers. The advantage of the proposed technique is that it provides a full defence against DDoS at multi-level without creating any traffic overhead.