Abstract: An apparatus has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to receive domain name system (DNS) query event data. A timestamp, source internet protocol (IP) address, and fully qualified domain name (FQDN) value are extracted from each DNS query event record. Each FQDN value is classified to generate corresponding key-value pairs. For each source IP address, key-value pairs during a period of time are counted. It is determined if a FQDN value or key-value pair value indicates anomalous behavior. One or more alert messages are generated if anomalous behavior is determined.

Abstract: A traffic filter for a decentralised peer-to peer data network is described. The data network comprises a number of interconnected ultrapeer nodes, each ultrapeer node being arranged to accept connections from a number of leaf nodes; maintain a database identifying material available from each connected leaf node, receive search queries from connected leaf nodes and other ultrapeers, forward received search queries to connected ultrapeers and provide data from the database matching a received search query. The traffic filter includes an ultrapeer node, a filter module and a protected material database. Upon receiving a search query the ultrapeer node is arranged to pass the query to the filter module.