However, such a simplistic model is inadequate for dealing with today’s realities, necessitating a paradigm shift. Many modern cyberattacks originate from multiple hosts, involve multiple sessions, and aim at multiple targets simultaneously. Such multipoint attacks defy traditional approaches to systems security such as standalone malware or intrusion detection. Rather, the presence of distributed attacks must be derived from behavioral patterns involving evidence from many hosts.10 Likewise, patterns hold valuable behavioral information.