1. A computer-implemented method of identifying a legitimate search query spike using a computing system having memory, processor, and data storage subsystems, the computer-implemented method comprising: receiving a plurality of search query requests from one or more user input devices; identifying one or more spikes in the received search query requests; clustering the identified spikes together according to a temporal or textual correlation; determining a rate of acceleration in which each spike in the search query requests is received via the processor of the computing system; comparing the determined rate of acceleration for the clustered identified spikes with a similar temporal behavior of stored clusters; identifying a particular clustered spike of received search query requests as a malicious attack when the determined rate of acceleration exceeds a first threshold level and a comparison to temporal behavior is lower than a second threshold level; and storing non-malicious clustered spikes of received search query requests and results as one or more content groups in the data storage subsystem of the computing system for comparison and query suggestions to future related search query requests.