Abstract: The present invention relates to a method and to an apparatus for detecting anomalies of an infrastructure in a network comprising analysing, through a network analyser (101) connected to the network, a data packet (PD) exchanged in the network, identifying an identified protocol and identified fields of said data packet (PD), extracting one or more allowed fields and one or more allowed protocols from a predefined devices knowledge database, comparing the allowed fields and the allowed protocols respectively with the identified fields and the identified protocol defining at least one critical state of the infrastructure when the identified fields differ from the allowed fields or when the identified protocol differ from the allowed protocols.

Abstract: The present invention relates to a method and to an apparatus for detecting anomalies of an infrastructure in a network comprising analysing, through a network analyser (101) connected to the network, a data packet (PD) exchanged in the network, identifying, through said network analyser (101), the network protocol and all the fields for said analysed data packet (PD) defining an identified protocol and identified fields of said data packet (PD), extracting, through computerized data processing means (102), identification fields from the identified fields to identify a device of the infrastructure in the network, matching, through the computerized data processing means (102), the identified device with a plurality of predefined standard devices in a predefined devices knowledge database to recognise a matching device, retrieving, through the computerized data processing means (102), one or more allowed fields and one or more allowed protocols of the matching device from the predefined devices knowledge databa