threat detection - works on a limited list of patterns
threat tree bulding
pattern matcher