In the scenarios of specific conditions and crises such as the coronavirus pandemic, the availability of e-learning ecosystem elements is further highlighted. The growing importance for securing such an ecosystem can be seen from DDoS (Distributed Denial of Service) attacks on e-learning components of the Croatian e-learning system. The negative impact of the conducted attack is visible in numerous users who were prevented from participating in and implementing the planned teaching process. Network anomalies such as conducted DDoS attacks were identified as one of the crucial threats to the e-learning systems. In this paper, an overview of the network anomaly phenomenon was given and botnets' role in generating DDoS attacks, especially IoT device impact. The paper analyzes the impact of the COVID-19 pandemic on the e-learning systems in Croatia. Based on the conclusions, a research methodology has been proposed to develop a cyber-threat detection model that considers the specifics of the application of e-learning systems in crisis, distinguishing flash crowd events from anomalies in the communication network. The proposed methodology includes establishing a theoretical basis on DDoS and flash crowd event traffic, defining a laboratory testbed setup for data acquisition, development of DDoS detection model, and testing the applicability of the developed model on the case study. The implementation of the proposed methodology can improve the quality of the teaching process through timely DDoS detection and it gives other socio-economic contributions such as developing a specific research domain, publicly available dataset of network traffic, and raising the cyber-security of the e-learning systems.