Patent ID: 8601564

Claim:
A method for protecting a packet-based network from attacks, comprising the steps of: performing a signature analysis on a packet stream received in a security border node of the packet-based network to detect attacks by comparing signatures of the packet stream with a set of signatures of previously identified attacks; performing, by the security border node, an anomaly detection on at least part of the packet stream to detect anomalies in the packet stream; updating, by the security border node, the set of signatures when the anomalies in the packet stream are detected, the updated set of signatures being subsequently used to perform the signature analysis; distributing, by the security border node, at least one signature of the updated set of signatures to at least one further security border node of the packet-based network; and performing, by the security border node, an anomaly detection by semantic processing on application layer control messages of the packet stream to identify semantically incorrect application layer control messages, and updating the set of signatures based on the identified semantically incorrect application layer control messages.