16. The non-transitory computer-readable storage medium of claim 13 , wherein each protocol primitive in the intercepted communication, and the DTD, is representable as a tree structure including a root node and one or more leaf nodes, each leaf node representing a protocol information element, wherein comparing a protocol primitive in the intercepted communication with the DTD comprises: locating a sub-tree structure within the DTD that corresponds to the tree structure of the protocol primitive; and for each of the one or more protocol information elements of the protocol primitive, traversing the tree structure of the protocol primitive from the root node to the leaf node representing the protocol information element; and identifying, from the corresponding sub-tree structure within the DTD, the LI attributes of the leaf node representing the protocol information element to thereby identify the LI attributes of the respective protocol information element.
18. The non-transitory computer-readable storage medium of claim 16 , wherein identifying the LI attributes of the leaf node comprises identifying the LI attributes of the leaf node and of any parent nodes of the leaf node.