1. A method, comprising: by a network server, monitoring network traffic received within a target virtual private network comprising a plurality of network addresses including a dark network address assigned to a trap; by the network server, gathering data regarding the network traffic including determining a level of the network traffic destined for the dark network address; and by the network server, comparing the level of traffic to a predetermined threshold level to determine whether the network traffic is unauthorized.