| 摘要 |
A method of and apparatus for monitoring for security threats in computer network traffic is disclosed. The method comprises operating computer processing means (50) to carry out the steps of: monitoring (110) traffic between a network to be protected (10) and a second network (20), through a first gateway (40); in response to determining traffic between the network to be protected (10) and a new host in the second network (20), accessing (130) the new host through a second gateway (60); and comparing (140) traffic between the network to be protected (10) and the new host through the first gateway (40) with traffic between the computer processing means (50) and the new host through the second gateway (60), to detect an anomaly therebetween. The apparatus comprising the computer processing means (50), the computer processing means (50) programmed and operable to carry out the method.
|
