Abstract: An intrusion detection arrangement for communication networks comprising a network activity observer configured to monitor network traffic by the related traffic elements, such as data packets, thereof and to establish traffic profiles relative to the monitored traffic elements, such as one profile per each monitored traffic element, a misuse detector configured to determine a first indication of a probability of the profiled traffic representing malicious activity through co-operation with a model repository comprising at least one model characterizing a known intrusion attack, an anomaly detector configured to determine, at least logically in parallel with the misuse detector, a second indication of a probability of the profiled traffic representing anomalous activity through cooperation with a model repository comprising at least one model characterizing legitimate network activity, and a classifier configured to operate on said first and second indications to generate a classification decision on the natu

Abstract: An intrusion detection arrangement (101) for communication networks comprising a network activity observer (102) configured to monitor network traffic by the related traffic elements, such as data packets, thereof and to establish traffic profiles relative to the monitored traffic elements, such as one profile per each monitored traffic element, a misuse detector (104) configured to determine a first indication of a probability of the profiled traffic representing malicious activity through co-operation with a model repository (106) comprising at least one model characterizing a known intrusion attack, an anomaly detector (108) configured to determine, at least logically in parallel with the misuse detector, a second indication of a probability of the profiled traffic representing anomalous activity through cooperation with a model repository (110) comprising at least one model characterizing legitimate network activity, and a classifier (112) configured to operate on said first and second indications to gene

Abstract: There is provided a protocol analyser arrangement, comprising: more than one analyser module (100A, 100B, 100C) including: at least a processing unit (110) for controlling functions of the analyser module in each of the analyser modules; and a data transfer unit (106) coupled to the processing unit for communicating data with a data transmission system (221) in at least one analyser module. The more than one analyser module each further include a communication unit (108) coupled to the processing unit for communicating with one or more other communication units of the more than one analyser module thus forming a cluster of the analyser modules (210); and a processing unit (110) of any analyser module of the cluster of the analyser modules is configured to share processing resources of the analyser module with one or more other analyser modules in the cluster of the analyser modules.