When a certain distributed attack spreads in network, network hosts are classified into three types. The first type has undergone the distributed attack. The second type has the attacked likelihood. The third type is immune to the distributed attack. Distributed attack will cause congested links in network usually. Network security situation of distributed attack can be determined by attack severity degree of hosts and congestion condition of network. The paper analyzes distributed attack spread and builds an attack graph. The attack graph is used to reflect attacked status of hosts and congestion degree of network. Network security situation is deduced based on the graph.