A method for inhibiting malicious encrypted network traffic communicated via a network between a first and second computer system, the method comprising: monitoring network traffic over the network to detect a network connection as a new network connection; identifying characteristics of the network connection to determine a protocol of the network connection; retrieving a definition of a portion of network traffic for a network connection based on the determined protocol; evaluating an estimated measure of entropy for a portion of network traffic of the new network connection based on the retrieved definition, wherein the measure of entropy is a measure of a degree of indeterminacy of information communicated via the new network connection; comparing the estimated measure of entropy with a dictionary of one or more entropy measures, each of the one or more entropy measures being associated with a portion of network traffic of a malicious encrypted network connection, so as to determine if malicious encrypted network traffic is communicated over the network connection; and characterised in that responsive to a determination that malicious encrypted network traffic is communicated over the network connection, performing the steps of: a) extracting connection characteristics from network traffic for the network connection, the connection characteristics including information for communicating with an endpoint of the network connection; b) extracting a sample of encrypted payload data from network traffic for the network connection; and c) generating a plurality of messages for transmission to the endpoint, each of the messages being characterised by the connection characteristics and including a payload derived from the sample of encrypted payload data so as to overwhelm the endpoint with messages plausibly relating to the network connection in order that the endpoint substantially ceases to engage in malicious network communication with another endpoint, wherein the portion of network traffic is a continuous subset of the network traffic subsequent to a transport protocol handshake and up to a predetermined endpoint, and wherein the predetermined endpoint is selected to correspond to an end of an application protocol connection setup portion of network traffic. monitoring network traffic over the network to detect a network connection as a new network connection; identifying characteristics of the network connection to determine a protocol of the network connection; retrieving a definition of a portion of network traffic for a network connection based on the determined protocol; evaluating an estimated measure of entropy for a portion of network traffic of the new network connection based on the retrieved definition, wherein the measure of entropy is a measure of a degree of indeterminacy of information communicated via the new network connection; comparing the estimated measure of entropy with a dictionary of one or more entropy measures, each of the one or more entropy measures being associated with a portion of network traffic of a malicious encrypted network connection, so as to determine if malicious encrypted network traffic is communicated over the network connection; and characterised in that responsive to a determination that malicious encrypted network traffic is communicated over the network connection, performing the steps of: a) extracting connection characteristics from network traffic for the network connection, the connection characteristics including information for communicating with an endpoint of the network connection; b) extracting a sample of encrypted payload data from network traffic for the network connection; and c) generating a plurality of messages for transmission to the endpoint, each of the messages being characterised by the connection characteristics and including a payload derived from the sample of encrypted payload data so as to overwhelm the endpoint with messages plausibly relating to the network connection in order that the endpoint substantially ceases to engage in malicious network communication with another endpoint, a) extracting connection characteristics from network traffic for the network connection, the connection characteristics including information for communicating with an endpoint of the network connection; b) extracting a sample of encrypted payload data from network traffic for the network connection; and c) generating a plurality of messages for transmission to the endpoint, each of the messages being characterised by the connection characteristics and including a payload derived from the sample of encrypted payload data so as to overwhelm the endpoint with messages plausibly relating to the network connection in order that the endpoint substantially ceases to engage in malicious network communication with another endpoint, wherein the portion of network traffic is a continuous subset of the network traffic subsequent to a transport protocol handshake and up to a predetermined endpoint, and wherein the predetermined endpoint is selected to correspond to an end of an application protocol connection setup portion of network traffic.