1. A method of detecting malicious behaviour on a network comprising inspecting the contents of packets of data travelling through the network and attempting to detect the presence of data representing a memory location corresponding to a known memory location or range of memory locations in which a known system program is known to execute on a given type of system, and, upon making such a detection, checking for suspicious behaviour from one or both of the source or destination host of the packet and, upon detecting such suspicious behaviour, determining that there is a risk of the respective source and/or destination device having been infected by a malicious program.