是否有一种方法来检测DOS在ApplicationBeginRequest或任何其他事件

在我对你的问题的评论中(即，这实际上不会阻止DDOS，因为DDOS很可能发生在网络堆栈的较低级别)，这里有一个基于泄漏桶抽象的速率限制器，在过去的几年里，它很好地满足了我的目的:

public class RateLimiter
{
   private readonly double numItems;
   private readonly double ratePerSecond;
   private readonly ConcurrentDictionary<object, RateInfo> rateTable = 
                             new ConcurrentDictionary<object, RateInfo>();
   private readonly double timePeriod;
   public RateLimiter(double numItems, double timePeriod)
   {
       this.timePeriod = timePeriod;
       this.numItems = numItems;
       ratePerSecond = numItems / timePeriod;
   }
   public double Count
   {
       get
       {
           return numItems;
       }
   }
   public double Per
   {
       get
       {
           return timePeriod;
       }
   }
   public bool IsPermitted(object key)
   {
       var permitted = true;
       var now = DateTime.UtcNow;
        rateTable.AddOrUpdate(
            key,
            k => new RateInfo(now, numItems - 1d),
            (k, rateInfo) => {
                var timePassedSeconds = 
                                  (now - rateInfo.LastCheckTime).TotalSeconds;
                var newAllowance = 
                                  Math.Min(rateInfo.Allowance 
                                            + timePassedSeconds 
                                            * ratePerSecond,
                           numItems);
                if (newAllowance < 1d)
                {
                    permitted = false;
                }
                else
                {
                    newAllowance -= 1d;
                }
                return new RateInfo(now, newAllowance);
            });
        var expiredKeys = rateTable
               .Where(kvp => 
                   (now - kvp.Value.LastCheckTime) > 
                   TimeSpan.FromSeconds(timePeriod))
               .Select(k => k.Key);
        foreach (var expiredKey in expiredKeys)
        {
            Reset(expiredKey);
        }
       return permitted;
   }
   public void Reset(object key)
   {
        RateInfo rr;
        rateTable.TryRemove(key,out rr);
   }

   internal struct RateInfo
   {
       private readonly double allowance;
       private readonly DateTime lastCheckTime;
       public RateInfo(DateTime lastCheckTime, double allowance)
       {
           this.lastCheckTime = lastCheckTime;
           this.allowance = allowance;
       }
       public DateTime LastCheckTime
       {
           get
           {
               return lastCheckTime;
           }
       }
       public double Allowance
       {
           get
           {
               return allowance;
           }
       }
   }
}

确保你的密钥适合存储在哈希表中(例如，它们实现了等式和.GetHashCode)，并像这样使用它:

void Main()
{
    var limiter=new RateLimiter(5,1);   //permit 5 items every 1 second
    AddStuff(limiter);
    Thread.Sleep(10000);
}
async Task AddStuff(RateLimiter limiter)
{
    for(var i=0;i<10000;++i)
    {
        Console.WriteLine(limiter.IsPermitted("foo"));
        await Task.Delay(10);
    }
}

DDOS攻击是分布式拒绝服务。如果它是以一种聪明的方式完成的(使用半同步的僵尸网络，它不会疯狂地向您发送垃圾邮件，而是使用间歇性的请求泛滥)，那么我不确定是否真的存在一种检测它的好方法。检测DDoS需要大量的统计分析，而攻击者知道正在分析什么和如何分析，可以修补他的僵尸网络以绕过防御。

嗯，当每分钟有n个请求或类似的东西(MSDN, StackOverflow)时，你可以检测到你的站点过载。但是你会怎么做——只是中止它们并在过载期间禁止ip吗?在不造成附带损害的情况下，很难对DDoS进行可靠的分析和防范。