1. A method for performing threat detection in a network comprising: monitoring communications traffic in the network; identifying a data exchange pattern, the data exchange pattern comprising a pull of data corresponding to data transferred to an internal host from an internal network location and a push of data corresponding to data delivered from the internal host to an external host; determining whether the data exchange pattern is indicative of an insider threat by calculating a ratio of the pull of data relative to the push of data; and reporting a threat if abnormal behavior is identified, wherein the abnormal behavior corresponds to the ratio having a value of approximately 1.