Abstract: Structured Data Discovery and Cryptographic Analysis. In an embodiment, transport sessions are assembled from raw packets captured in network traffic. Data is extracted from two or more encapsulation layers of each transport session. In particular, each encapsulation layer may be classified into a protocol, and data may be extracted from the encapsulation layer based on the protocol. For example, cryptographic metadata may be extracted from a cryptographic encapsulation layer. The extracted data is incorporated into a data model of the network, which comprises tallies of traffic within the network, grouped according to a plurality of dimensions. Analytic model(s) may be applied to the data model to, for example, generate a data web of the network that represents structured data stores and data flows to and/or from the data stores within the network.

Abstract: Systems, methods, and computer-readable media for detecting threats on a network. In an embodiment, target network traffic being transmitted between two or more hosts is captured. The target network traffic comprises a plurality of packets, which are assembled into one or more messages. The assembled message(s) may be parsed to generate a semantic model of the target network traffic. The semantic model may comprise representation(s) of operation(s) or event(s) represented by the message(s). Score(s) for the operation(s) or event(s) may be generated using a plurality of scoring algorithms, and potential threats among the operation(s) or event(s) may be identified using the score(s).