Abstract: Event information of a computing device is obtained. The event information characterizes events occurring at the computing device. Two or more of the events are grouped into an event group. The event group defines an activity. The event group is classified to classify the activity. The activity and one or more related activities are chained into a sequence. The sequence defines a behavior. Context is added to the sequence to determine a contextual behavior. A security threat is detected based on the contextual behavior.

Abstract: Event information of a computing device is obtained. The event information characterizes events occurring at the computing device. Two or more of the events are grouped into an event group. The event group defines an activity. The event group is classified to classify the activity. The activity and one or more related activities are chained into a sequence. The sequence defines a behavior. Context is added to the sequence to determine a contextual behavior. A security threat is detected based on the contextual behavior.

Abstract: In one example, a network device includes a network interface that receives a packet, a storage card that stores session data for monitored network sessions, a plurality of service processing cards that process packets of respective subsets of the network sessions, wherein each of the service processing cards comprises a respective memory to store session data for the respective subset of the network sessions processed by the corresponding service processing card, and a switch fabric coupled to the network interface, the storage card, and the plurality of service processing cards. One or more of the plurality of service cards process the received packet based on the session data stored by the storage card. The one or more of the plurality of service cards retrieve the session data for the network session to which the packet corresponds from the storage card and store the retrieved session data in the respective memory.