Abstract: The application relates to a method and apparatus for ranking data relating to use of a communications network according to the likelihood that the use is fraudulent, the method comprising receiving a first data set comprising a plurality of parameter values relating to each of a plurality of observed fraudulent uses of the communications network and establishing a first model for the parameters of the first data set, receiving a second data set comprising a plurality of parameter values relating to each of a plurality of observed non-fraudulent uses of the communications network and establishing a second model for the parameters of the second data set, receiving a third data set comprising a plurality of parameter values relating to a subsequent use of the communications network, applying the third data set to the first and second models, determining the likelihoods that the third data set is compatible with the first and second models and determining a ranking for the subsequent use within a plurality of su