In the presented investigation, communication security aspects are analyzed in an audited protocol operation run. The run is represented by mutually interleaved protocols. Each protocol consists of communication operations and these operations are decomposed into action sets. An action can play the role of an argument in logic rules described in works [3]. Rules help to extract security attributes which will be corrected after every operation. The action recognition is part of the proposed method and the adequate algorithm refers to protocols, keys, messages and users. The correction part refers to jurisdiction over m essage, believing in user honesty, key sharing, information freshness, the degree of encryption, etc. The investigation analysis and equivalent procedures are not complex and may be realized dynamically during the auditing process.