The present invention provides a method and system of detecting malicious behavior in a series of data transmission de-duplication requests of a de-duplicated computer system. In an exemplary embodiment, the method and system include, (1) if the series includes at least one particular de-duplication request for particular data and a reply to the particular request that the system does not have the particular data, processing at least one subsequent response and (2) determining the existence of the behavior from the at least one subsequent response.