1. A method for detecting an attack in a computer network, comprising: monitoring communication traffic transmitted over connections on the network that are associated with a stateful application protocol so as to detect respective states of the connections; and analyzing a distribution of the states so as to detect the attack.