What packet parameters should be checked to detect layer-7 DDoS attack (http flood, slow http request etc.)? Do window size and packet timeline show enough information to detect attack traffic from legitimate traffic? What are the other parameters need to be verified?
could you supply more info. Parameter's in what app/system?
The things you're talking about (packet features) are layer-3 (packet level) features.
These have nothing to do with whatever's happening at layer 7 (application) level - different things can be happening at the different layers with no relation, and an attack mostly working at layer 7 (like someone spamming, say, a search field in your website) won't necessarily have any defining features at layer3. If it does, it could likely be easily changed on their side without changing the rest of the attack.