A method for detecting an attack in a computer network includes monitoring
communication traffic transmitted over connections on the network that
are associated with a stateful application protocol so as to detect
respective states of the connections, and analyzing a distribution of the
states so as to detect the attack.