Abstract: There are many solution based methods created against Distributed Denial Of Service (DDoS) attacks are focused on the Transmission Control Protocol and Internet Protocol layers as a substitute of the high layer. An extended hidden semi-Markov model is proposed to describe the browsing habits of web searchers. A forward algorithm is derived for the online implementation of the model based on the M-algorithm in order to reduce the computational amount introduced by the model’s large state space. Entropy of the user’s HTTP request sequence accurate to the replica is used as a principle to measure the user’s normality. Finally, experiments are conducted to validate our model and algorithm.