A system, comprising: a communication interface; and a processor coupled to the communication interface and configured to: intercept from each implementation in a plurality of implementations (214, 216, 218) a network message, the network messages received from the respective implementations comprising a related set of network messages, wherein the plurality of implementations includes three or more implementations; wherein intercepting comprises receiving network traffic in a network protocol from a client and acting as an intermediary with the respective implementations before sending a responsive action, wherein the network protocol comprises at least one of the following: SMTP, HTTP, TCP, IP, UDP, RPC, IMAP and TLS; compare each received network message in the related set of network messages with each other received network messages in the related set of network messages to determine whether any network message in the related set of network messages deviates from any one or more other network messages in the related set of network messages; wherein comparing comprises determining a protocol stack layer of a network protocol stack for the network protocol to perform a semantic comparison upon; determine a statistical mode of the related set of network messages based at least in part through said semantic comparison, wherein the statistical mode of the related set of network messages is a specific network message from the related set of network messages that appears most often; and determine the responsive action based at least in part on the statistical mode. a communication interface; and a processor coupled to the communication interface and configured to: intercept from each implementation in a plurality of implementations (214, 216, 218) a network message, the network messages received from the respective implementations comprising a related set of network messages, wherein the plurality of implementations includes three or more implementations; wherein intercepting comprises receiving network traffic in a network protocol from a client and acting as an intermediary with the respective implementations before sending a responsive action, wherein the network protocol comprises at least one of the following: SMTP, HTTP, TCP, IP, UDP, RPC, IMAP and TLS; compare each received network message in the related set of network messages with each other received network messages in the related set of network messages to determine whether any network message in the related set of network messages deviates from any one or more other network messages in the related set of network messages; wherein comparing comprises determining a protocol stack layer of a network protocol stack for the network protocol to perform a semantic comparison upon; determine a statistical mode of the related set of network messages based at least in part through said semantic comparison, wherein the statistical mode of the related set of network messages is a specific network message from the related set of network messages that appears most often; and determine the responsive action based at least in part on the statistical mode. intercept from each implementation in a plurality of implementations (214, 216, 218) a network message, the network messages received from the respective implementations comprising a related set of network messages, wherein the plurality of implementations includes three or more implementations; wherein intercepting comprises receiving network traffic in a network protocol from a client and acting as an intermediary with the respective implementations before sending a responsive action, wherein the network protocol comprises at least one of the following: SMTP, HTTP, TCP, IP, UDP, RPC, IMAP and TLS; compare each received network message in the related set of network messages with each other received network messages in the related set of network messages to determine whether any network message in the related set of network messages deviates from any one or more other network messages in the related set of network messages; wherein comparing comprises determining a protocol stack layer of a network protocol stack for the network protocol to perform a semantic comparison upon; determine a statistical mode of the related set of network messages based at least in part through said semantic comparison, wherein the statistical mode of the related set of network messages is a specific network message from the related set of network messages that appears most often; and determine the responsive action based at least in part on the statistical mode.