Handling potentially malicious communication activity

Apparatus for handling potentially malicious communication activity in a communication system, including processing communication activity which is potentially malicious differently to communication activity which is acceptable, the apparatus being configured to:

• distribute at least some incoming traffic into a first set of traffic groups according to a first grouping scheme such that communication activity from a potentially malicious source may be grouped in a given traffic group in which communication activity from an acceptable source is also grouped;
• detect potentially malicious communication activity in the given traffic group;
• process the traffic in the given traffic group using a first traffic processing mode associated with potentially malicious communication activity, the first traffic processing mode comprising discarding at least some traffic, both from the acceptable source and the potentially malicious source, that is distributed into the given traffic group;
• process the traffic in at least one other traffic group using a second traffic processing mode associated with acceptable communication activity;
• and
• in response to a dynamic trigger, alter the grouping scheme to one or more further grouping schemes and distributing at least some subsequent incoming traffic into one or more further sets of traffic groups according to the one or more further grouping schemes in order that the communication activity from an acceptable source is likely to be subsequently grouped into a traffic group which is different to a group into which the communication activity from the potentially malicious source is subsequently grouped.

A computer program product comprising a non-transitory computer-readable storage medium having computer readable instructions stored thereon, the computer readable instructions being executable by a computerized device to cause the computerized device to perform a method of handling potentially malicious communication activity in a communication system, including processing communication activity which is potentially malicious differently to communication activity which is acceptable, the method comprising:

• detecting potentially malicious communication activity in the given traffic group;
• distributing at least some incoming traffic into a first set of traffic groups according to a first grouping scheme such that communication activity from a potentially malicious source may be grouped in a given traffic group in which communication activity from an acceptable source is also grouped;
• processing the traffic in the given traffic group using a first traffic processing mode associated with potentially malicious communication activity, the first traffic processing mode comprising discarding at least some traffic, both from the acceptable source and the potentially malicious source, that is distributed into the given traffic group;
• processing the traffic in at least one other traffic group using a second traffic processing mode associated with acceptable communication activity;
• and
• in response to a dynamic trigger, altering the grouping scheme to one or more further grouping schemes and distributing at least some subsequent incoming traffic into one or more further sets of traffic groups according to the one or more further grouping schemes in order that the communication activity from an acceptable source is likely to be subsequently grouped into a traffic group which is different to a group into which the communication activity from the potentially malicious source is subsequently grouped.