Methods of detecting DNS flooding attack according to characteristics of type of attack traffic

A method of detecting an attack by checking a DNS packet transmitted over a network in a computer device connected to the network, comprising:

• when the DNS packet includes a first query message:
• determining whether a first previous entry corresponding to the DNS packet exists;
• when the first previous entry does not exist, creating a new entry for the DNS packet, the new entry including an entry generation time;
• and
• when the first previous entry exists, dropping the DNS packet when a receive time of the DNS packet is within a threshold time of the entry generation time of the first previous entry and updating the entry generation time of the previous entry using a current time;
• and
• when the DNS packet includes a response message:
• determining whether a second previous entry corresponding to a previous DNS packet including a second query message corresponding to the response message exists;
• determining the DNS packet as a packet related to the attack when the second previous entry does not exist;
• and
• deleting the second previous entry when the second previous entry exists.