1. A method for performing threat detection in a network comprising: monitoring communications traffic in the network; performing a first threat detection phase by identifying a data exchange pattern involving an internal host and an external host; performing a second threat detection phase by analyzing the data exchange pattern determine whether it is indicative of an insider threat; and reporting a threat if abnormal behavior is identified.