A method for screening data packets received at a service infrastructure supporting a plurality of legitimate services, comprising: receiving a data packet at the service infrastructure, the data packet comprising a header and a content (104, 106), wherein the content (104, 106) is distinct from the header; successively applying each signature of a set of signatures as a mask to a predetermined area of the content, wherein the signatures relate to the legitimate services or to known attacks; and if there is a byte-for-byte match between the predetermined area of the content and one of the signatures, taking an action corresponding to the one of the signatures: if the one of the signatures corresponds to a known attack, unconditionally discarding the data packet; and if the one of the signatures corresponds to one of the legitimate services: in case no signature-based flow threshold is defined for the one of the legitimate services, unconditionally forwarding the data packet toward the one of the legitimate services; characterized in that the method further comprises: in case a signature-based flow threshold is defined for the one of the legitimate services, wherein the signature based flow threshold corresponds to a maximum number of data packets to be received for the one of the legitimate service over a period: forwarding the data packet toward the one of the legitimate services, if the signature-based flow threshold is not exceeded by a current flow of data packets directed to a server of the infrastructure hosting the legitimate service; and discarding the data packet if the signature-based flow threshold is met or exceeded by the current flow of data packets directed to the server of the infrastructure hosting the legitimate service. receiving a data packet at the service infrastructure, the data packet comprising a header and a content (104, 106), wherein the content (104, 106) is distinct from the header; successively applying each signature of a set of signatures as a mask to a predetermined area of the content, wherein the signatures relate to the legitimate services or to known attacks; and if there is a byte-for-byte match between the predetermined area of the content and one of the signatures, taking an action corresponding to the one of the signatures: if the one of the signatures corresponds to a known attack, unconditionally discarding the data packet; and if the one of the signatures corresponds to one of the legitimate services: in case no signature-based flow threshold is defined for the one of the legitimate services, unconditionally forwarding the data packet toward the one of the legitimate services; if the one of the signatures corresponds to a known attack, unconditionally discarding the data packet; and if the one of the signatures corresponds to one of the legitimate services: in case no signature-based flow threshold is defined for the one of the legitimate services, unconditionally forwarding the data packet toward the one of the legitimate services; characterized in that the method further comprises: in case a signature-based flow threshold is defined for the one of the legitimate services, wherein the signature based flow threshold corresponds to a maximum number of data packets to be received for the one of the legitimate service over a period: forwarding the data packet toward the one of the legitimate services, if the signature-based flow threshold is not exceeded by a current flow of data packets directed to a server of the infrastructure hosting the legitimate service; and discarding the data packet if the signature-based flow threshold is met or exceeded by the current flow of data packets directed to the server of the infrastructure hosting the legitimate service. forwarding the data packet toward the one of the legitimate services, if the signature-based flow threshold is not exceeded by a current flow of data packets directed to a server of the infrastructure hosting the legitimate service; and discarding the data packet if the signature-based flow threshold is met or exceeded by the current flow of data packets directed to the server of the infrastructure hosting the legitimate service.