Abstract: A process for detecting anomalous network traffic in a communications network, the process including: generating reference address distribution data representing a statistical distribution of source addresses of packets received over a first time period, the received packets being considered to represent normal network traffic; generating second address distribution data representing a statistical distribution of source addresses of packets received over a second time period; and determining whether the packets received over the second time period represent normal network traffic on the basis of a comparison of the second address distribution data and the reference address distribution data.

Abstract: A network analysis system obtains parameter data generated by telecommunications network equipment, in which the parameter data represents operational parameters of the network. The network analysis system processes the parameter data to generate symptom data from test procedures that are applied to the parameter data. Fault data is generated that is representative of faults that may have occurred, on the basis of the symptom data and relationship data representative of the relationship between the symptom data and the faults. The relationship between a symptom and a fault represents likelihood of the symptom being caused by the fault. The system also generates occurrence data that is representative of faults that probably have occurred, on the basis of the fault data.