System and method for protecting computer device against overload via network attack

An apparatus for use with a stateful packet processing device of a computer network for mitigating effects of a network overload against said device, said apparatus operable to free memory used to store information about communications sessions managed by said device, said system comprising:

• a classification component operable to determine, for each session cache entry, the cache class to which that entry belongs according to one or more characteristics of the entry;
• a memory management database for tracking the amounts of memory used for each category of entry, as well as for tracking the total amount of memory used for all entries;
• a pruning component that is used to select and delete entries;
• and
• a processor for determining when said device is experiencing network overload and selecting specific cache session entries for deletion until sufficient memory has been freed.

A cache management system used in connection with session-type packet processing devices of a computer network, said system comprising:

• a memory management database for storing communication traffic classification and memory threshold values;
• a memory monitor for tracking overall memory usage and determining when said memory threshold values stored in said memory management database are reached;
• a cache classifier used to determine a class into which a given session of communications traffic falls;
• and
• a pruner mechanism for selecting and pruning selected sessions of said packet processing device in accordance with said communication traffic classification and memory thresholds programmed in said memory management database when said memory threshold value is reached.