Network traffic threat identification

1. A computer implemented method to identify a computer security threat based on communication via a computer network, the method comprising:

receiving a definition of acceptable network communication characteristics for each of a plurality of communication protocols;

receiving a set of security events for the communication, each security event including network communication characteristics for the communication;

for each security event in the set of security events:

identifying a communication protocol associated with the security event,

detecting deviations of the network communication characteristics of the security event from the acceptable network communication characteristics for the identified communication protocol, wherein the detecting includes determining an extent of deviation as a measure of difference between the deviated communication characteristic and the acceptable network communication characteristic,

generating a record of each deviation, the record identifying a deviated communication characteristic for which the deviation is detected,

identify a commonality between a set of generated deviation records and another set of generated deviation records, and

deduplicate the commonality between the set of generated deviation records and the another set of generated deviation records; and

identifying a computer security threat for the communication based on the records generated of each deviation for the set of security events.

2. The method of claim 1 , further comprising:

receiving a definition of one or more computer security threats, each computer security threat being defined, for each of one or more communication protocols, by a set of deviations from the acceptable network communication characteristic for the communication protocol,

wherein identifying a computer security threat for the communication includes comparing the records generated for the set of security events to the received definition of one or more computer security threats.

3. The method of claim 1 , wherein the definition of acceptable network communication characteristics for each of the plurality of communication protocols is based on a specification of the communication protocol.

4. The method of claim 2 , wherein the one or more computer security threats are further defined by an extent or range of extents of the deviation from the acceptable network communication characteristics for the communication protocol.

5. The method of claim 1 , wherein the one or more of the records of each deviation further identifies an extent of the deviation between the network communication characteristics of the security event from the acceptable network communication characteristics for the identified communication protocol.

6. The method of claim 1 , wherein the network communication characteristics include one or more of:

a size, a range of sizes, a volume, a range of volumes, a rate or a range or rates of data in the communication;

a size or a range of sizes of a header of a message in the communication;

characteristics of a source entity to the communication;

characteristics of a destination entity to the communication; or

features of the communication protocol.

7. The method of claim 6 , wherein the features of the communication protocol include one or more of:

an order of messages or types of message according to one or more protocol definitions; or

a message structure or format.

8. The method of claim 6 , wherein the characteristics of the source entity include one or more of:

a particular port of the source entity;

a set of ports of the source entity; or

a number of ports of the source entity.

9. The method of claim 6 , wherein the characteristics of the destination entity include one or more of:

a particular port of the destination entity;

a set of ports of the destination entity; or

a number of ports of the destination entity.

10. The method of claim 1 , wherein the security events are received from one or more computer security services.

11. The method of claim 10 , wherein the one or more of the computer security services include:

an intrusion detection system;

a malware detection system;

a firewall; a proxy;

an antivirus system; or

a spyware detection system.

12. A computer system comprising:

a processor and memory storing computer program code for identifying a computer security threat based on communication via a computer network, the processor and memory configured to:

receive a definition of acceptable network communication characteristics for each of a plurality of communication protocols;

receive a set of security events for the communication, each security event including network communication characteristics for the communication;

for each security event in the set of security events:

identify a communication protocol associated with the security event,

detect deviations of the network communication characteristics of the security event from the acceptable network communication characteristics for the identified communication protocol, wherein the detecting includes determining an extent of deviation as a measure of difference between the deviated communication characteristic and the acceptable network communication characteristic,

generate a record of each deviation, the record identifying a deviated communication characteristic for which the deviation is detected,

identify a commonality between the set of generated deviation records and another set of generated deviation records, and

deduplicate the commonality between the set of generated deviation records and the another set of generated deviation records; and

identify a computer security threat for the communication based on the records generated of each deviation for the set of security events.

13. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .