A monitoring apparatus for a network of communications-enabled devices, the apparatus comprising: a processing resource arranged to support a data selection module and a data analysis module; a communications interface for communication with a plurality of devices (106, 108), the communications interface being operably coupled to the processing resource and arranged to receive a plurality of data fragments; wherein each data fragment of the plurality of data fragments bears a respective device identifier and associated observation data, the plurality of data fragments respectively comprising a plurality of unique device identifiers; the data selection module is arranged to read the respective identifiers of the plurality of data fragments and the associated observation data and to identify a set of the plurality of data fragments reflecting origination from devices sharing a common device characteristic; the data analysis module is arranged to analyse the set of the plurality of data fragments identified by the data selection module; the data selection module is also arranged to identify another set of the plurality of data fragments reflecting origination from devices sharing the common device characteristic; and the data analysis module is arranged to analyse the another set of the plurality of data fragments identified by the data selection module and to detect anomalous device activity from the analysis of the set of the plurality of data fragments with respect to a predetermined operational parameter and analysis of the another set of the plurality of data fragments; the data selection module is also arranged to identify another common device characteristic of the set of the plurality of data fragments; the data analysis module is arranged to analyse the set of the plurality of data fragments identified by the data selection module with respect to the another common device characteristic, thereby increasing confidence in the detection of the anomalous device activity from the analysis using the common device characteristic. a processing resource arranged to support a data selection module and a data analysis module; a communications interface for communication with a plurality of devices (106, 108), the communications interface being operably coupled to the processing resource and arranged to receive a plurality of data fragments; wherein each data fragment of the plurality of data fragments bears a respective device identifier and associated observation data, the plurality of data fragments respectively comprising a plurality of unique device identifiers; the data selection module is arranged to read the respective identifiers of the plurality of data fragments and the associated observation data and to identify a set of the plurality of data fragments reflecting origination from devices sharing a common device characteristic; the data analysis module is arranged to analyse the set of the plurality of data fragments identified by the data selection module; the data selection module is also arranged to identify another set of the plurality of data fragments reflecting origination from devices sharing the common device characteristic; and the data analysis module is arranged to analyse the another set of the plurality of data fragments identified by the data selection module and to detect anomalous device activity from the analysis of the set of the plurality of data fragments with respect to a predetermined operational parameter and analysis of the another set of the plurality of data fragments; the data selection module is also arranged to identify another common device characteristic of the set of the plurality of data fragments; the data analysis module is arranged to analyse the set of the plurality of data fragments identified by the data selection module with respect to the another common device characteristic, thereby increasing confidence in the detection of the anomalous device activity from the analysis using the common device characteristic.