Method of analysing anomalous network traffic

A telecommunications network comprising:

• a plurality of network entities, including a first network entity;
• a security analyser, wherein security analyser is configured to
• receive a network communication from the first network entity;
• identify the first network entity;
• analyse the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication;
• in response to identifying the network communication as an anomalous communication, communicate an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity;
• and
• commencing with the preceding network entity, iteratively communicate an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified;
• and
• a remediator for applying a security policy to the identified source network entity;
• wherein:
• the security analyser is further configured to generate the security policy in dependence on a signature of the anomalous communication that is generated in dependence on the origin information;
• and
• the communication of the instruction is performed in response to a determination that only an incomplete signature of the anomalous communication can be generated.

A security analyser comprising storage memory storing computer-readable code and at least one processor which upon execution of the code enables the security analyser to at least be configured to:

• receive a network communication from a first network entity;
• identify the first network entity;
• analyse the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication;
• in response to identifying the network communication as an anomalous communication, communicate an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity;
• and
• commencing with the preceding network entity, iteratively communicate an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified;
• and
• apply a security policy to the identified source network entity;
• wherein:
• the security analyser is further configured to generate the security policy in dependence on a signature of the anomalous communication that is generated in dependence on the origin information;
• and
• the communication of the instruction is performed in response to a determination that only an incomplete signature of the anomalous communication can be generated.