Application layer DDOS (distributed denial of service) attack and defense method

The invention relates to an application layer DDOS (distributed denial of service) attack and defense method, which is easy to realize, is low in time complexity and high in accuracy, is transparent to users, and has no influence on the user visit. The method provided by the invention is divided to two stages of a training stage and a work stage. In the training stage, real and legal visit flow is adopted as training data to generate a standard array used for real-time detection and protection of the work stage. According to the invention, application layer DDOS equipment needs to be arranged in front of an application server in series, so that the visit flow can be filtered through a defense device before entering the server.