3 in this embodiment the netflow processing engine 3 collects a plurality of flow records within a predefined time window which could be any amount of time such as an hour or a few days fig5 shows the contents of an exemplary flow record containing relevant information about a flow as shown in fig5 the fields include a flow record may be emitted at regular time intervals for example each minute by a router for each flow so a single long lived flow would generate many flow records a filter for a specific query may be applied to each flow examples of such a filter may be flows within a certain time range or flows that match particular interfaces etc the filter may be composed of filter parameters for any combination of fields available in a flow record the filter parameters may be defined by values or range of values for the associated field for example a range of ip address values may be defined for example as a net mask and a port range may be defined from a start value to an end value in this embodiment the netflow processing engine 3 is configured as mentioned above for detection of distributed denial of service and or port scan network attacks and therefore collects and analyses flow records within a predetermined time window in order to efficiently identify active.