Abstract: Distributed Denial of Service is an attempt to make a machine or network resource unavailable to its intended users．With the further development of technology,DDOS attacks on the network layer have been largely weakened．However,more and more attacks occur in the application layer with various and more complicated forms．Attack traffic may be legitimate from the view of the lower layer protocol,which makes the detection and prevention more difficult．This article explained the discipline and measures of application DDOS attack by instances,summarizes and improves the mechanism of detection and prevention with present technology.

Key words: DDOS,Attack detection,Attack prevention,Network security