A device of overload protection for an Internet system comprises: an acquisition module configured to acquire data from a flow mirror image of a network flow prior to the acquisition module reaching a rear-end application; a decision module configured to determine the load degree about the rear-end application according to the data and determine the protection strategy; and a protective module configured to execute the protection strategy.