1. A computer-implemented method for use in a database system, the database system including a client system coupled to an internal network receiving communication traffic over a network connection to an external network, the method comprising: detecting a secure shell session established by the client system over the network connection with a foreign server coupled to the external network; monitoring packets in the secure shell session; determining a transmission direction and a payload size of each of the packets; analyzing the transmission directions and payload sizes of a first sequence of the packets relative to a predetermined pattern; based on the first sequence of packets matching the pattern, assessing a payload size of a response to the first sequence of packets from the client system to the foreign server; and identifying the secure shell session as hosting a reverse shell session based on the response payload size exceeding a predetermined threshold.