Shared tap DOS-attack protection

A method and system are provided for centralizing services subscribed to by customers of a service provider for detecting attacks at the customer-end of a communications network. A signal diverter is installed in a signal path carrying inbound communication signals common to subscribed customers and a portion of the collective inbound signals for each customer is diverted to a detection apparatus. Finally, based on parameters for each subscribed customer, a determination is made as to if a subscribed customer is experiencing an attack.