44. The system of claim 24 , wherein assembling the plurality of packets into one or more messages comprises: synchronizing the plurality of packets; sorting each of the plurality of packets into one of two host queues according to the transmission direction of the packet; processing the two host queues into a single push queue by alternately processing the packets in one of the two host queues until a packet is encountered which cannot be disposed of or the host queue is empty and then processing the packets in the other one of the two host queues until a packet is encountered that cannot be disposed of or the host queue is empty; if loss of a packet is detected, generating a synthetic gap packet to stand in for the lost packet; and bundling packets in the single push queue into the one or more messages, wherein each of the one or more messages is a request message or a response message.
24. A system for detecting threats on a network, the system comprising: at least one hardware processor; and one or more executable modules that, when executed by the at least one hardware processor, capture target network traffic being transmitted between two or more hosts, wherein the target network traffic comprises a plurality of packets, assemble the plurality of packets into one or more messages, parse the assembled one or more messages to generate a semantic model of the target network traffic, wherein the semantic model comprises one or more representations of one or more operations or events represented by the one or more messages, generate one or more scores for the one or more operations or events using a plurality of scoring algorithms, and identify one or more potentially threatening ones of the one or more operations or events based on the one or more scores.