Monitoring apparatus and method therefor

A method of detecting a malicious attack in a communications network, the method comprising:

• receiving a bit stream;
• identifying a characteristic of a malicious attack from at least one datagram represented by at least part of the bit stream;
• accessing identification data stored by a data store to enable identification of the characteristic of the malicious attack;
• and
• generating an alert in response to an identification of the characteristic of the malicious attack;
• and
• recognising a received datagram containing replacement identification data indicative of a need to update the data store.

A monitoring apparatus for detection of a malicious attack in a communications network, the apparatus comprising:

• a pattern matching engine arranged to receive a bit stream and identify a characteristic of a malicious attack from at least one datagram represented by at least part of the bit stream;
• an alert generator arranged to generate an alert in response to an identification of the characteristic of the malicious attack;
• and
• an alert processing entity operably coupled to the alert generator, the alert processing entity being arranged to receive the alert constituting alert information and limit communication of the alert information for receipt by an alert information collection unit.

A method of detecting a malicious attack in a communications network, the method comprising:

• receiving a bit stream;
• identifying a characteristic of a malicious attack from at least one datagram represented by at least part of the bit stream;
• generating an alert in response to an identification of the characteristic of the malicious attack;
• recognising a received datagram containing replacement identification data indicative of a need to update the data store;
• and
• processing the alert constituting alert information and limiting communication of the alert information for receipt by an alert information collection unit.