Abstract: A method, apparatus, signals and medium for detecting self propagation of a self-propagating program involves producing difference values, each difference value representing a difference between volume of data traffic transmitted in a transmit direction and volume of data traffic received in a receive direction, in successive periods of time, incrementing an anomaly event counter when one of the difference values satisfies a difference criterion and setting an indicator active when the anomaly event counter reaches a value that meets a count criterion.

Abstract: A system and method of analyzing data traffic associated with messages being sent through a communications network is provided. The method comprises receiving data traffic, obtaining characteristics of data traffic and identifying packet flooding by analyzing the characteristics. The system and method may analyze the data traffic to determine whether the data traffic is not bursty. The system and method may also correlate characteristics of the data traffic to a Hurst parameter. The system and method may respond to packet flooding by terminating a connection associated with data traffic. Denial of service attacks can be prevented by analyzing statistics regarding the network data traffic.