A method comprising: receiving (S610) at a node of a communication system, one or more data packets comprising software from an interconnection network; searching (S620), by the node in a data store for a rule of its set of rules which applies to the one or more data packets, wherein applying a rule to the one or more data packets comprises blocking the one or more data packets, blocking part of the one or more data packets and allowing the remaining part of the one or more data packets through the node , or allowing the one or more data packets through the node ; if a rule is identified in the data store for the one or more data packets, applying (S630), by the node , that rule to the one or more data packets; if no rule is identified in the data store for at least part of the one or more data packets, transmitting (S640), by the node , the at least part of one or more data packets to a test system ; receiving (S710), at the test system , the at least part of the one or more data packets; providing , by the test system , the at least part of the one or more data packets to a virtualised environment that is a virtualisation of the communication system comprising a virtualisation of a core network comprising one or more virtualised network nodes of the communication system, determine , by the test system , a threat level associated with the at least part of the one or more data packets from test results obtained by running the software of the at least part of the one or more data packets in the virtualised environment; transmitting , by the test system , information of the threat level associated with the at least part of the one or more data packets to the node ; and updating (S650), by the node , rules for the at least part of the one or more data packets in the data store based on the threat level. receiving (S610) at a node of a communication system, one or more data packets comprising software from an interconnection network; searching (S620), by the node in a data store for a rule of its set of rules which applies to the one or more data packets, wherein applying a rule to the one or more data packets comprises blocking the one or more data packets, blocking part of the one or more data packets and allowing the remaining part of the one or more data packets through the node , or allowing the one or more data packets through the node ; if a rule is identified in the data store for the one or more data packets, applying (S630), by the node , that rule to the one or more data packets; if no rule is identified in the data store for at least part of the one or more data packets, transmitting (S640), by the node , the at least part of one or more data packets to a test system ; receiving (S710), at the test system , the at least part of the one or more data packets; providing , by the test system , the at least part of the one or more data packets to a virtualised environment that is a virtualisation of the communication system comprising a virtualisation of a core network comprising one or more virtualised network nodes of the communication system, determine , by the test system , a threat level associated with the at least part of the one or more data packets from test results obtained by running the software of the at least part of the one or more data packets in the virtualised environment; transmitting , by the test system , information of the threat level associated with the at least part of the one or more data packets to the node ; and updating (S650), by the node , rules for the at least part of the one or more data packets in the data store based on the threat level. <EOS>