1. An apparatus comprising a processor and a memory storing executable instructions that in response to execution by the processor cause the apparatus to at least perform the following: intercepting a communication from a sender to a receiver, the communication being formatted in a structured mark-up language, the mark-up language including at least one protocol primitive for an application that sends and receives communications, each protocol primitive including one or more protocol information elements that carry information about a communication, each protocol information element including lawful interception (LI) attributes that include at least one of a type of content and a level of interception; comparing a protocol primitive in the intercepted communication with a document type definition (DTD) for the mark-up language, to identify the LI attributes of the protocol information elements in the intercepted communication, the DTD specifying the LI attributes of the protocol information elements; and preparing one or more of the protocol information elements in the intercepted communication for transmission to an interception monitoring facility according to the LI attributes of the protocol information elements.
4. The apparatus of claim 1 , wherein each protocol primitive in the intercepted communication, and the DTD, is representable as a tree structure including a root node and one or more leaf nodes, each leaf node representing a protocol information element, wherein comparing a protocol primitive in the intercepted communication with the DTD comprises: locating a sub-tree structure within the DTD that corresponds to the tree structure of the protocol primitive; and for each of the one or more protocol information elements of the protocol primitive, traversing the tree structure of the protocol primitive from the root node to the leaf node representing the protocol information element; and identifying, from the corresponding sub-tree structure within the DTD, the LI attributes of the leaf node representing the protocol information element to thereby identify the LI attributes of the respective protocol information element.