Patent ID: 8341742

Claim:
A network attack detection method for detecting a fast-flux domain name system attack, comprising: collecting a domain name system packet; extracting a plurality of internet protocol addresses corresponding to the domain name system packet according to the domain name system packet; generating spatial feature data corresponding to the internet protocol addresses according to the internet protocol addresses, spatial coordinate data and standard time zone data; and determining whether the domain name system packet is an attack according to the spatial feature data and a spatial snapshot detection model, and when determining that the domain name system packet is an attack, sending a warning to indicate the attack, wherein the spatial feature data comprises time zone coordinate data and scatter degree data, wherein the time zone coordinate data is generated by corresponding a first spatial geographical coordinate group and a second spatial geographical coordinate croup to a first time zone coordinate croup and a second time zone coordinate croup, respectively, according to the standard time zone data, and estimating time zone distribution of the first time zone coordinate group and the second time zone coordinate group by information theory.