of an someone taking actions in preparation of an attack and so demonstrates how the present invention may be used as an early warning system to allow that will detect an attack before it occurs examples of such source code are available on the internet from a variety of sources the source code is not executable and so will pass by most filters blocks and virus scanning software the source code can be downloaded by a variety of protocols including http ftp email and the like hence conventional systems for protecting a network perimeter are not effective however the source code itself which is transported in text form will include words and terms that are indicative of malicious intent source code may contain terms such as u201c stacksmasher u201d u201c logwiper u201d or u201c sniffer u201d which would identify the source code as potentially troublesome linguistic analysis can readily distinguish this type of source code from ordinary text or from desirable source code related to legitimate corporate purposes specific implementation of the present invention may be used to detect and report unauthorized access attempts for file transfer protocol ftp internet message access protocol imap post office protocol pop and other protocols root activity characteristic of hackers such as viewing password files suspicious activity such as attempts to gain u201c superuser u201d rights u201c setuid root u201d and generating nmap output within a shell session the creation of u201c backdoors u201d on critical systems packets containing these types of information are examples of activities that might suggest an attack in the planning stage the present invention recognizes and reports on network.