Abstract: A method of mitigating an application distributed denial of service (DDoS) attack on a network includes receiving at an application DDoS mitigation appliance application layer logs, parsing the application layer logs into an application layer forensic file, comparing an entry of the application layer forensic file with a human behavior profile to determine a malicious qualifier associated with an application DDoS attack on the network, parsing the application layer log into a per-source forensic file, comparing an entry of the per-source forensic files with the malicious qualifier to determine a malicious Internet protocol (IP) addresses associated with the application DDoS attack, and providing the malicious IP address to a network device, wherein the network device drops network traffic associated with the application DDoS attack based upon the malicious IP address.