1. A method of responding to an overload condition at a network element (“victim”) in a set of one or more potential victims on a network, the method comprising the steps of: A. responsively to an indication of an anomalous traffic condition, initiating diversion of traffic destined for the victim by a first set of one or more network elements external to the set of one or more potential victims to a second set of one or more network elements external to the set of one or more potential victims, B. the element(s) of the second set filtering traffic diverted in step A (“diverted traffic”) and selectively passing a portion thereof to the victim, wherein said filtering step includes detecting any of (i) a traffic pattern that differs from an expected pattern and (ii) traffic volume that differs from an expected volume, said expected pattern and said expected volume being determined during a period in which the victim is not at an overload condition, and wherein said detecting step includes determining whether any of the traffic pattern and volume varies statistically significantly from any of the expected pattern and volume, respectively.