System and method for extracting and preserving metadata for analyzing network communications

A system for protecting a computer network from electronic communication containing malicious code in the form of an advanced persistent threat, comprising:

• a network;
• a processor coupled to the network and configured to;
• capture the electronic communication from the network as it is received to provide captured data;
• determining a packet type for data packets of the captured data;
• decoding the data packets to provide decoded packet data;
• reassembling a communication session from the decoded packet data to provide a reassembled communication session;
• perform layered session decoding on the reassembled communication session while the electronic communication is in progress to provide decoded session data;
• and
• extract session metadata from the decoded session data while the electronic communication is in progress;
• extract packet metadata from the decoded packet data while the electronic communication is in progress;
• a memory coupled to the processor for storing the session metadata and packet metadata;
• and
• wherein, the session metadata and packet metadata may be analyzed to detect the advanced persistent threat on the network.

A non-transitory computer readable medium for protecting a computer network from electronic communication containing malicious code in the form of an advanced persistent threat, comprising instructions stored thereon, that when executed by a processor, perform the steps of:

• detecting an advanced persistent threat by:
• capturing the electronic communication from a network as it is received via a processor to provide captured data;
• determining a packet type for the captured data;
• decoding the data packets to provide decoded packet data;
• reassembling a communication session from the decoded packet data to provide a reassembled communication session;
• performing layered session decoding on the reassembled communication session while the electronic communication is in progress to provide decoded session data;
• extracting session metadata from the decoded session data while the electronic communication is in progress;
• extract packet metadata from the decoded packet data while the electronic communication is in progress;
• and
• analyzing the session metadata and packet metadata to detect the advanced persistent threat on the network.