Patent ID: 7607170

Claim:
A computer-implemented method for protecting a computer network, comprising: monitoring communication traffic transmitted between clients outside the protected network and an application server inside the protected network over connections on the network that are associated with a stateful application protocol implemented by the application server; implementing a state machine that tracks the connections between the clients and the application server, and makes transitions between state machine states based on application commands and replies generated by the clients and application server, in accordance with rules of the stateful application protocol, so as to detect respective application states of the connections; analyzing a distribution of the application states so as to detect an attack on the application server; and filtering traffic entering the network in order to block traffic participating in the attack, wherein analyzing the distribution comprises interpreting as indicative of the attack a number of connections in one of the application states that is beyond a certain number of standard deviations from an average number of connections in the other application states.