Have a read of this question for some more information on how DoS attacks work.
For this specific case, the attack is using a function you are allowing (sleep) to force wait cycles until your database can no longer respond.
A solution for you may be to disallow the sleep command entirely, unless you have a need for it. A better solution is to prevent all connection to your database except through stored procedures, so that only those commands you need to run your application are allowed. This will make it that much harder for an attacker to find and exploit a hole.
