Integrated network threat analysis

A method for correlating network session and file information, the method comprising:

• receiving packet data at a receiver module, the packet data comprising a network communication session;
• identifying a portion of the packet data representing a file being transferred over the network between a source and a destination;
• associating the identified portion of the packet data with the file being transferred;
• reassembling the identified portions of the packet data to create a recomposed file;
• storing the recomposed file in an electronic data storage device;
• analyzing the packet data associated with the file to extract a network communication session parameter associated with the file;
• storing in the electronic data storage device, the extracted session parameter;
• storing in the electronic data storage device, information identifying the recomposed file;
• generating a logical link between the information identifying the recomposed file and the extracted session parameter based on the association between the identified portion of the packet data and the file being transferred;
• prompting a user to enter a parameter descriptive of a target network communication session;
• receiving the parameter descriptive of the target network communication session;
• executing a query in the electronic data storage device to identify a file associated with the received parameter descriptive of the target network communication session based on the logical link between the information identifying the recomposed file and the extracted session parameter;
• returning an identification of the file associated with the received parameter descriptive of the target network communication session;
• prompting a user to enter a parameter descriptive of a target file transferred over the network;
• receiving the parameter descriptive of the target file transferred over the network;
• executing a query in the electronic data storage device to identify a network communication session associated with the received parameter descriptive of the target file transferred over the network based on the logical link between the information identifying the recomposed file and the extracted session parameter;
• returning an identification of the network communication session associated with the received parameter descriptive of the target file transferred over the network;
• and
• calculating a threat score based on a weighted analysis of the recomposed file, wherein the weighting is based on one or more of reliability, false positive rate, and false negative rate of the analysis;
• and
• wherein the calculated threat score is associated with the recomposed file and the session parameter.