1. A method for identifying a pattern of messages which is characteristic of a malicious intrusion, the method comprising the steps of: a server receiving information identifying a destination IP address, a destination port and a signature of each of a multiplicity of messages having an indicia of a malicious intrusion, and in response, determining a total number of different destination IP addresses, a total number of different destination ports and a total number of different signatures of messages of the multiplicity of messages sent from each of a plurality of source IP addresses during each of a plurality of intervals of substantially the same duration; and the server determining that there are (a) a first total number of different destination IP addresses, a second total number of different destination ports and a third total number of different signatures for the messages sent from one of the source IP addresses during one of the intervals and (b) approximately the first total number of different destination IP addresses, approximately the second total number of different destination ports and approximately the third total number of different signatures for the messages sent from the one source IP addresses during another of the intervals, and in response in part to an approximate repetition of (A) the number of different destination IP addresses for the messages sent from the one source IP addresses during the one and other intervals, (B) the number of different destination ports for the messages sent from the one source IP addresses during the one and other intervals, and (C) the number of different signatures for the messages sent from the one source IP addresses during the one and other intervals, the server determining that the one source IP address has sent a pattern of messages which is characteristic of a malicious intrusion.