Method and apparatus for detecting anomalies of an infrastructure in a network

An apparatus for detecting anomalies of an infrastructure in a network comprising:

• a network analyser (101) to be connected to a network,
• a computerized data processing means (102) operatively connected to said network analyser (101) and a predefined devices knowledge database operatively connected to said computerized data processing means,
• wherein said network analyser (101) in use analyses a data packet (PD)
• exchanged in said network and identifies the network protocol and all the fields for said analysed data packet (PD) defining an identified protocol and identified fields of said data packet (PD), said network analyser (101) being configured to identify said network protocol and said fields by analysing only said data packet (PD) without aggregating information from multiple data packets,
• wherein said computerized data processing means (102) in use extracts identification fields from said identified fields to identify a device of said infrastructure in said network,
• wherein said computerized data processing means (102) in use matches said identified device with a plurality of predefined standard devices in said predefined devices knowledge database to recognise a matching device,
• wherein said computerized data processing means (102) in use retrieves one or more allowed fields and one or more allowed protocols of said matching device from said predefined devices knowledge database, wherein said computerized data processing means (102) in use compares said allowed fields and said allowed protocols respectively with said identified fields and said identified protocol as directly obtained by said identification through the network analyser defining at least one critical state of said infrastructure when said identified fields differ from said allowed fields or when said identified protocol differs from said allowed protocols, and
• wherein said computerized data processing means (102) in use signals an anomaly of said infrastructure when at least one of said critical states is identified;
• wherein said computerized data processing means (102) in use wherein the analysis and the resulting action are performed in a real-time push mode by analysing a single data packet to provide instantaneous assessment and bypass the need of aggregation of multiple data packets or learning phase.