Patent ID: 8429747

Claim:
A flood attack detection method, the method being carried out by a computer device having a processor, comprising the steps of: receiving, by the device, source packets transmitted from a plurality of hosts, wherein the source packets include text content; and counting, by the device, a total quantity of the received source packets carrying a keyword in a predetermined time to obtain a total quantity of the source packets with the keyword, wherein each received source packet's text content carries the keyword; and obtaining, by the device, a quantity of a characteristic parameter of the source packets; and wherein if a ratio of the quantity of the characteristic parameter of the source packets to the total quantity of the source packets with the keyword exceeds or is equal to a preset threshold, it is determined that the flood attack occurs, wherein the characteristic parameter of the source packets is a repetition number of a text hash string in the source packets, and wherein the preset threshold is a similar threshold.