1. A method, comprising: capturing data packets from a network via a processor to provide captured packets; performing layered session decoding on the captured packets to provide decoded packets; extracting metadata from the decoded packets; storing the metadata; and analyzing the metadata to detect advanced persistent threats on the network.