Abstract: A system and method is disclosed for correlating transaction messages in a communications network into transaction records. A plurality of monitoring units capture the messages from the links in the communication network. A processor or state machine processes the correlated transaction records and detects calls to particular destination telephone numbers. Transactions affecting particular destination point codes can also be detected or monitored. When a short-term threshold number of calls to a particular telephone number are detected, the detecting monitor instructs other monitors to track calls to that telephone number. If a long-term threshold number of calls are detected for the destination telephone number, then a mass call alarm is generated. Information comprising the highly called destination telephone number, dialed number, destination point code, and top originating point codes is provided to the service provider following the mass call alarm.