Systems and methods for threat analysis of computer data

A system comprising:

• at least one processor;
• and
• a memory storing instructions configured to instruct the at least one processor to perform:
• aggregating a plurality of threat signatures from a plurality of threat signature data sources;
• analyzing bit stream data, based on the plurality of threat signatures, to detect a first threat in the bit stream data, wherein a second threat is not detected in the bit stream data, the bit stream data being analyzed using a signature-based threat analysis;
• logging a result of analyzing the bit stream data as threat analysis log data;
• analyzing the threat analysis log data to detect the second threat in the bit stream data, the threat analysis log data being analyzed using a heuristic-based threat analysis;
• triggering an action based on the analyzing the bit stream data and based on the analyzing the threat the analysis log data, wherein the action includes configuring a network device to address the first threat in response to the first threat being detected in the bit stream data and configuring the network device to address the second threat in response to the second threat being detected in the bit stream data.

A non-transitory computer storage medium storing computer-executable instructions that, when executed, cause a computer system to perform a computer-implemented method comprising:

• aggregating a plurality of threat signatures from a plurality of threat signature data sources;
• analyzing bit stream data, based on the plurality of threat signatures, to detect a first threat in the bit stream data, wherein a second threat is not detected in the bit stream data, the bit stream data being analyzed using a signature-based threat analysis;
• logging a result of analyzing the bit stream data as threat analysis log data;
• analyzing the threat analysis log data to detect the second threat in the bit stream data, the threat analysis log data being analyzed using a heuristic-based threat analysis;
• triggering an action based on the analyzing the bit stream data and based on the analyzing the threat the analysis log data, wherein the action includes configuring a network device to address the first threat in response to the first threat being detected in the bit stream data and configuring the network device to address the second threat in response to the second threat being detected in the bit stream data.