SGNET : automated protocol learning for the observation of malicious threats