Abstract: For monitoring traffic in a communications network, network protocol requests sent over the network are obtained. The resulting network protocol responses sent over said network are also obtained. It is then determined which request corresponds to which response and each request and corresponding response pair is stored as a single request-response record. Preferably, the time of capture of the request in each record is stored. Moreover, a request lookup key may be created from specific attributes of the request. The requests and responses preferably adhere to the domain name system (DNS) protocol.

Abstract: Units of data are obtained from a communications network. Each unit of data comprises a plurality of attributes and is associated with a respective timestamp. For analysing the network communications data, a time interval is specified, and for that time interval a signature is generated by a signature generator 120 from each unit of network communications data whose timestamp is in that time interval. The number of occurrences of each distinct signature in that time interval is counted, and a resulting table of counts corresponding to each signature is stored in a record store 40. The table of counts represents a time series of domain name system (DNS) queries in a network.