1. A method for detecting threats on a network, the method comprising: capturing target network traffic being transmitted between two or more hosts, wherein the target network traffic comprises a plurality of packets; and using at least one hardware processor to assemble the plurality of packets into one or more messages, parse the assembled one or more messages to generate a semantic model of the target network traffic, wherein the semantic model comprises one or more representations of one or more operations or events represented by the one or more messages, generate one or more scores for the one or more operations or events using a plurality of scoring algorithms, and identify one or more potentially threatening ones of the one or more operations or events based on the one or more scores.
1. A method for detecting threats on a network, the method comprising: capturing target network traffic being transmitted between two or more hosts, wherein the target network traffic comprises a plurality of packets; and using at least one hardware processor to assemble the plurality of packets into one or more messages, parse the assembled one or more messages to generate a semantic model of the target network traffic, wherein the semantic model comprises one or more representations of one or more operations or events represented by the one or more messages, generate one or more scores for the one or more operations or events using a plurality of scoring algorithms, and identify one or more potentially threatening ones of the one or more operations or events based on the one or more scores. 20. The method of claim 1 , wherein at least one of the plurality of scoring algorithms parses a structured query language (SQL) statement into a plurality of segments, and determines whether the plurality of segments satisfy one or more criteria.