Stateful attack protection

Apparatus for detecting an attack in a computer network, the apparatus comprising a network security processor, which is adapted to monitor communication traffic transmitted over connections on the network that are associated with a stateful application protocol so as to detect respective states of the connections, and analyze a distribution of the states so as to detect the attack.

Apparatus for protecting a server on a communication network, the apparatus comprising a network security processor, which is adapted to:

• monitor messages transmitted over the communication network for forwarding by the server so as to determine respective numbers of recipients specified by the messages,
• adaptively set an attack threshold responsively to the numbers of the recipients specified by a plurality of the messages, and
• identify as malicious one of the messages that specifies a number of recipients that is equal at least to the attack threshold.

A computer software product for detecting an attack in a computer network, the product comprising a computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to monitor communication traffic transmitted over connections on the network that are associated with a stateful application protocol so as to detect respective states of the connections, and analyze a distribution of the states so as to detect the attack.

A computer software product for protecting a server on a communication network, the product comprising a computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to monitor messages transmitted over the communication network for forwarding by the server so as to determine a respective number of recipients specified by each of the messages, identify a source address of one of the messages for which the number of recipients is equal at least to a threshold, track a cumulative number of the recipients specified in a plurality of the messages from the identified source address, and determine the source address to be malicious responsively to the cumulative number.

A computer software product for protecting a server on a communication network, the product comprising a computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to monitor messages transmitted over the communication network for forwarding by the server so as to determine respective numbers of recipients specified the messages, adaptively set an attack threshold responsively to the numbers of the recipients specified by a plurality of the messages, and identify as malicious one of the messages that specifies a number of recipients that is equal at least to the attack threshold.