A computer implemented method to identify a computer security threat based on communication via a computer network according to a communication protocol, wherein the method comprises: receiving a definition of acceptable network communication characteristics for each of a plurality of communication protocols, wherein the definition of acceptable network communication characteristics for a communication protocol is based on a specification of the protocol; receiving a set of security events for the communication, each security event including network communication characteristics for the communication; for each security event in the set of security events: a) identifying the communication protocol associated with the event; b) detecting deviations of network communication characteristics of the event from the acceptable network communication characteristics for the identified communication protocol; and c) generating a record of each deviation identifying a communication characteristic for which the deviation from the acceptable network communication characteristics for the identified communication protocol is detected, and identifying a computer security threat for the communication based on the records generated for the set of security events, wherein the identification of the computer security threat is based on a previous observation of the security threat and measures of deviation of communication characteristics of network communication according to the protocol for the previous observation. receiving a definition of acceptable network communication characteristics for each of a plurality of communication protocols, wherein the definition of acceptable network communication characteristics for a communication protocol is based on a specification of the protocol; receiving a set of security events for the communication, each security event including network communication characteristics for the communication; for each security event in the set of security events: a) identifying the communication protocol associated with the event; b) detecting deviations of network communication characteristics of the event from the acceptable network communication characteristics for the identified communication protocol; and c) generating a record of each deviation identifying a communication characteristic for which the deviation from the acceptable network communication characteristics for the identified communication protocol is detected, and identifying a computer security threat for the communication based on the records generated for the set of security events, wherein the identification of the computer security threat is based on a previous observation of the security threat and measures of deviation of communication characteristics of network communication according to the protocol for the previous observation. a) identifying the communication protocol associated with the event; b) detecting deviations of network communication characteristics of the event from the acceptable network communication characteristics for the identified communication protocol; and c) generating a record of each deviation identifying a communication characteristic for which the deviation from the acceptable network communication characteristics for the identified communication protocol is detected, and