Abstract: System and Method for detecting anomalous network application behavior. Network traffic between at least one client and one or more servers may be monitored. The client and the one or more servers may communicate using one or more application protocols. The network traffic may be analyzed at the application-protocol level to determine anomalous network application behavior. Analyzing the network traffic may include determining, for one or more communications involving the client, if the client has previously stored or received an identifier corresponding to the one or more communications. If no such identifier has been observed in a previous communication, then the one or more communications involving the client may be determined to be anomalous. A network monitoring device may perform one or more of the network monitoring, the information extraction, or the information analysis.

Abstract: A system and method for capture and resumption of network application sessions in a network system. A transaction may be detected between a client and server that includes application session state information. The session state information may relate to a session between the client and the server. The Application session state information may be recorded in response to the detection of the transaction, and the application session state information may not be deleted according to session information expiration policies (e.g., of the client). User input may be received which requests to review the captured network application session. Correspondingly, a network request comprising captured credentials of the captured session may be generated and forwarded to the server. The network request may be usable to enable resumption of the captured network application session.