While Distributed Denial of Service Attack in Application layer (APP-DDOS) is popular, it is also becomes more difficult for people to defend it. Based on the current defense technology, this paper presents a new defense model on the basis of “score strategy”, which can identify the user through IP, use the score strategy to dynamically adjust the user’s scores, and respond to users’ service request according to score value. The model not only ensures the normal users' effective access to the maximum, but also shields abnormal requests quickly. The relevant experiment proves that the model has a good defense effect on HTTP protocol attacks.