Abstract: Web server can't provide normal service for users under DDoS attack. DDoS attack on application layer is different from DDoS attack on network layer, and each request sent by DDoS attack on application layer is legal. Slow DDoS attack mainly uses thread-based architecture characteristics of Web server. Web server of this type will open a new thread for every new connection. After the attacker has built a normal HTTP connection with Web server successfully, he will hold this connection through all kinds of methods to take up a lot of resources of Web server. The principle of slow DDoS on application layer is analyzed and related defense methods are proposed, which can improve ability to resist DDoS attack of Web server and safety performance.

Key words: Web server, slow DDoS attack, security defense