This paper proposes a clustering- based DDoS attack detection method for application layer. Firstly, the method collects web server network traffic, and selects four attributes to form the traffic feature vector after data preprocessing. Then, the K-means clustering algorithm optimized by particle swarm optimization is used to establish the detection model, and the attack behavior is identified through the model. Experimental results show that this method can effectively identify DDoS attacks in application layer and has higher detection rate compared with k-means algorithm.