1. A network security device comprising: one or more processors; and a non-transitory storage device having embodied therein instructions representing: a traffic file receive module, which when executed by the one or more processors receives a traffic file containing therein network traffic of a private network that has been captured and stored; a network traffic protocol determination module, which when executed by the one or more processors avoids affecting network traffic performance within the private network by performing post processing of the received traffic file, including: determining whether the network traffic relates to a network protocol that is potentially indicative of existence of a network security threat within the private network; and when said determining is affirmative, detecting the existence of the network security threat by evaluating the received traffic file against traffic patterns associated with existence of one or more of a plurality of known network security threats within the private network, wherein the traffic patterns discover communication between a botnet or an Advanced Persistent Threat (APT) and a command and control server and wherein the traffic patterns include: a first detection rule that (i) performs decryption of encrypted data contained within a Hypertext Transfer Protocol (HTTP) POST request to produce plaintext data and (ii) compares the plaintext data to a first detection pattern; and a second detection rule that (i) performs decryption of an encrypted payload of a dofoil network traffic protocol stream to produce a plaintext result and (ii) compares the plaintext result to a second detection pattern; and a malware reporting module, which when executed by the one or more processors reports details regarding the network security threat of the plurality of known network security threats when the network traffic protocol determination module determines existence of the network security threat within the private network.