IT computer network threat analysis, detection and containment

A software threat analysis, detection and containment system comprising:

• a data aggregation model configured to receive and aggregate data from a plurality of sources in a computer network;
• a classification engine configured to classify the aggregated data;
• a plurality of data sets wherein the classified data is stored;
• a model creation engine configured to generate threat models based on content of each of the plurality of data sets;
• a prediction and analysis engine configured to generate actionable information and predictions based on content of each of the threat models;
• a first plurality of sensors embedded in the computer network, the first plurality of sensors being configured to monitor and report suspicious traffic in the computer network;
• a second plurality of sensors embedded in the computer network, the second plurality of sensors being adapted to scout, monitor and capture new network traffic patterns in a computer network, wherein at least some of the second plurality of sensors are convertible into additional of the first plurality of sensors when an amount of suspicious traffic exceeds a threshold for the first plurality of sensors;
• and
• a software decoy configured to lure the suspicious traffic from within the computer network to an isolated deception network, the isolated deception network being configured to trap the suspicious traffic.