A controller (104) for managing operations of a communication network has a communication element (202) for monitoring data traffic of an IP address in the communication network and for controlling operations of the communication network, a memory for storage (204), and a processor (206) for controlling operations of the communication element, and the memory. The processor is programmed to select 302) an IP (Internet Protocol) address to analyze, monitor (304) for the effects of malicious software originating from the IP address utilized by one or more customers, detect (306) a suspected malicious event, and restrict (312) Internet access to one or more customers suspected of interrupting service of the communication network.