Attack protection for a packet-based network

A protection unit (15) for protecting a packet-based network (1) from attacks, comprising:

• a signature analyzer (5) for analyzing a packet stream (6) received in a security border node (2a) of the network (1) and for detecting attacks by comparing signatures of the packet stream (6) with a set of signatures of previously identified attacks,
• an anomaly detector, in particular a statistical analyzer (7), for detecting anomalies in the packet stream (6),
• a signature interference unit (9) for updating the set of signatures when anomalies in the packet stream (6) are detected, the updated set of signatures (12) being subsequently used by the signature analyzer (5) for performing the signature analysis,
• a distribution unit (13) for distributing at least one signature of the updated set of signatures (12) to at least one further, preferably to each further security border node (2b to 2f) of the packet-based network (1),
• characterized by:
• a signaling stack, preferably a SIP stack (16), for performing an anomaly detection on application layer control messages, in particular on SIP messages, contained in the packet stream (6), the updating of the set of signatures in the signature interference unit (9) taking the result of the anomaly detection into account.