1. A network protection system comprising: one or more networked devices configured to operate as at least one of a monitoring agent and an interdiction agent, wherein the monitoring agent comprises at least one of monitoring devices, event sensors, and monitoring software executable on the networked devices and configured to monitor data traffic and recognize events that are potential threats; and at least one threat correlation device communicably coupled with the networked devices, the threat correlation device comprising a processor and at least one memory storage device, the at least one processor configured to execute a computer program stored in the memory storage device, the computer program including: a code segment for receiving information from the monitoring agent regarding an event recognized by the monitoring agent; a code segment for retrieving an event score for the event from a risk scoring database based on at least one of an event type, a destination of the event, and a number of occurrences of the event; a code segment for updating a risk score stored in an aggressor threat database based upon the event score, wherein the risk score is associated with an aggressor and the event type; and a code segment for, when the risk score is at or above at least one threshold, sending instructions to the interdiction agent to take protective action or to execute a defensive response associated with at least one of the at least one threshold, data traffic of the event type and data traffic from the aggressor.