1. A system, comprising: a server computer having a processor, the server computer in communication with a network; and instructions stored on the server computer, executable by the server computer, the instructions configuring the server computer to receive a plurality of messages in a network, the network comprising a plurality of endpoints and UC application servers, the plurality of messages contained within a unified communication (UC) stream having a transport stream and an application stream, wherein the unified communication stream comprises one or more streams related to one or more of IP-PBX, video, desktop conferencing, web conferencing, collaboration, presence, unified messaging, instant messaging (IM), voicemail, Interactive Voice Response (IVR), Automatic Call Distribution (ACD) or contact center applications, and wherein the application stream comprises session states correlating to a plurality of applications; inspect the plurality of messages at a transport layer and an application layer to determine whether the UC stream corresponds to a positive flow model, the positive flow model defining legitimate flow streams to distinguish the legitimate flow streams from potential attacks or bad behaviors by providing real-time analysis of a UC state level and correlating the UC state level with a learned behaviors baseline; record positive attributes of the UC stream, wherein positive attributes include UC session variant data, UC session invariant data, user and device profiles, system properties, security profiles, application profiles, protocol properties, UC application transactions, and server behaviors; store in a database a plurality of address-of-record (AOR) records in an address-of-record (AOR) table, the AOR table storing positive attributes, properties of previously received messages from the plurality of endpoints, and learned behaviors of the plurality of endpoints; analyze a message from an endpoint of the plurality of endpoints to produce a system event and correlate the system event with the learned behaviors and plurality of AOR records in the database; and classify the message into one of a whitelist, a blacklist, and a graylist based on a score of the message, wherein the whitelist contains AOR records that are legitimate, the blacklist contains AOR records that are a potential attack, and the graylist contains AOR records that belong to neither the whitelist nor the blacklist.