System and process for detecting anomalous network traffic

A system for detecting anomalous network traffic in a communications network, the system including:

• a source address distribution generator for generating:
• reference address distribution data representing a statistical distribution of source addresses of packets received over a first time period, the received packets being considered to represent normal network traffic;
• and
• second address distribution data representing a statistical distribution of source addresses of packets received over a second time period;
• and
• a network traffic assessment component for determining whether the packets received over the second time period represent normal network traffic on the basis of a comparison of the second address distribution data and the reference address distribution data.