A content distribution network, comprising: a plurality of playback devices (16A, 16B, 18A) connected to a headend via a network, where the headend includes at least one content protection system; a clone monitor configured to register playback devices based upon a unique identification supplied by each playback device, when communicating with the at least one content protection system; wherein the clone monitor is configured to: intercept message between the plurality of playback devices (16A, 16B, 18A) and the headend; store content found within the intercepted messages associated with each playback, where the content found within the intercepted messages includes at least one request for a cryptographic key; aggregate the stored content of messages associated with each playback device (16A, 16B, 18A) over time; analyze the aggregated content of messages for at least one pattern of abnormal behavior related to a specific unique identifier supplied by the plurality of playback devices; and detect that a clone playback device is connected to the headend based upon the at least one pattern of abnormal behavior, wherein the at least one pattern of abnormal behavior includes number of cryptographic keys issued to the specific unique identifier exceeding a predetermined number. a plurality of playback devices (16A, 16B, 18A) connected to a headend via a network, where the headend includes at least one content protection system; a clone monitor configured to register playback devices based upon a unique identification supplied by each playback device, when communicating with the at least one content protection system; wherein the clone monitor is configured to: intercept message between the plurality of playback devices (16A, 16B, 18A) and the headend; store content found within the intercepted messages associated with each playback, where the content found within the intercepted messages includes at least one request for a cryptographic key; aggregate the stored content of messages associated with each playback device (16A, 16B, 18A) over time; analyze the aggregated content of messages for at least one pattern of abnormal behavior related to a specific unique identifier supplied by the plurality of playback devices; and detect that a clone playback device is connected to the headend based upon the at least one pattern of abnormal behavior, wherein the at least one pattern of abnormal behavior includes number of cryptographic keys issued to the specific unique identifier exceeding a predetermined number. intercept message between the plurality of playback devices (16A, 16B, 18A) and the headend; store content found within the intercepted messages associated with each playback, where the content found within the intercepted messages includes at least one request for a cryptographic key; aggregate the stored content of messages associated with each playback device (16A, 16B, 18A) over time; analyze the aggregated content of messages for at least one pattern of abnormal behavior related to a specific unique identifier supplied by the plurality of playback devices; and detect that a clone playback device is connected to the headend based upon the at least one pattern of abnormal behavior, wherein the at least one pattern of abnormal behavior includes number of cryptographic keys issued to the specific unique identifier exceeding a predetermined number.