2. The method of claim 1 , wherein said analyzing the packet headers to identify anomalous conversations based on a conversation uniqueness comprises determining whether a particular conversation has been conducted on the IP network over a historical and statistically relevant period based on an IP-to-IP-on-Port conversation tuple.
3. The method of claim 2 , wherein said determining whether a particular conversation has been conducted on the IP network over a historical and statistically relevant period comprises determining whether the IP-to-IP-on-Port conversation tuple was previously stored in the database.