A computer implemented method to identify a computer security threat based on communication via a computer network, characterised in that the method comprises: receiving a definition of acceptable network communication characteristics for each of a plurality of communication protocols, wherein acceptable network communication characteristics for a communication protocol are defined by a specification of the protocol; receiving a first set of security events for the communication, each security event including network communication characteristics for the communication; for each security event in the first set of security events: a) identifying a communication protocol associated with the event; b) detecting deviations of network communication characteristics of the event from the acceptable network communication characteristics for the identified communication protocol; and c) generating a record of each deviation identifying a communication characteristic for which the deviation is detected, so as to generate a set of one or more records of deviation for the first set of security events; and storing the set of records of deviation as a security threat identifier for identifying subsequent security threats by comparing with the set of records by the steps of: receiving a second set of security events for the communication; repeating steps a), b) and c) for the second set of security events so as to generate a set of one or more records of deviation for the second set of security events; and identifying the second set of security events as related to the same computer security threat as the first set of security events based on a comparison of security threat identifier and the set of records of deviation for the second set of security events. receiving a definition of acceptable network communication characteristics for each of a plurality of communication protocols, wherein acceptable network communication characteristics for a communication protocol are defined by a specification of the protocol; receiving a first set of security events for the communication, each security event including network communication characteristics for the communication; for each security event in the first set of security events: a) identifying a communication protocol associated with the event; b) detecting deviations of network communication characteristics of the event from the acceptable network communication characteristics for the identified communication protocol; and c) generating a record of each deviation identifying a communication characteristic for which the deviation is detected, a) identifying a communication protocol associated with the event; b) detecting deviations of network communication characteristics of the event from the acceptable network communication characteristics for the identified communication protocol; and c) generating a record of each deviation identifying a communication characteristic for which the deviation is detected, so as to generate a set of one or more records of deviation for the first set of security events; and storing the set of records of deviation as a security threat identifier for identifying subsequent security threats by comparing with the set of records by the steps of: receiving a second set of security events for the communication; repeating steps a), b) and c) for the second set of security events so as to generate a set of one or more records of deviation for the second set of security events; and identifying the second set of security events as related to the same computer security threat as the first set of security events based on a comparison of security threat identifier and the set of records of deviation for the second set of security events. receiving a second set of security events for the communication; repeating steps a), b) and c) for the second set of security events so as to generate a set of one or more records of deviation for the second set of security events; and identifying the second set of security events as related to the same computer security threat as the first set of security events based on a comparison of security threat identifier and the set of records of deviation for the second set of security events.