1. A computer-implemented method for protecting a computer network from electronic communication containing malicious code in the form of an advanced persistent threat, comprising executing on a processor the steps of: capturing the electronic communication as it is received by a network via the processor to provide captured data; determining a packet type for the captured data; decoding the data packets to provide decoded packet data; reassembling a communication session from the decoded packet data to provide a reassembled communication session; performing layered session decoding on the reassembled communication session while the electronic communication is in progress to provide decoded session data; extracting session metadata from the decoded session data while the electronic communication is in progress; extract packet metadata from the decoded packet data while the electronic communication is in progress; storing the session metadata and packet metadata; and analyzing the session metadata and packet metadata to detect the advanced persistent threat on the network.