A method for performing threat detection in a network comprising: monitoring communications traffic in the network to identify communications between key assets and other hosts within the network, wherein the key assets and the other hosts are behind a firewall, the firewall is logically placed at a boundary of the network to protect against external threats to the key assets, and the key assets each comprise a node, host, or server within the network having information identified as being sensitive; constructing a predictive model for a respective key asset of the key assets using metadata extracted from the communications traffic in the network, the predictive model being for use in detecting insider threats to corresponding key assets, the insider threats originating from a node within the network, constructing the respective predictive model by: identifying metadata for the respective key asset that describes connection patterns between the respective key asset and at least one host of the other hosts that communicates with the respective key asset, generating a corresponding dataspace representation of the connection patterns between the respective key asset and the at least one host on the network, the corresponding dataspace representation comprising at least one feature of the connection patterns between the respective key asset and the at least one host, and clustering the respective dataspace representation based on the at least one feature of the connection patterns; analyzing behaviors in the network relative to the predictive model to determine if respective behaviors are abnormal based on deviation from the predictive model; and generating a threat report when an abnormal behavior is identified. monitoring communications traffic in the network to identify communications between key assets and other hosts within the network, wherein the key assets and the other hosts are behind a firewall, the firewall is logically placed at a boundary of the network to protect against external threats to the key assets, and the key assets each comprise a node, host, or server within the network having information identified as being sensitive; constructing a predictive model for a respective key asset of the key assets using metadata extracted from the communications traffic in the network, the predictive model being for use in detecting insider threats to corresponding key assets, the insider threats originating from a node within the network, constructing the respective predictive model by: identifying metadata for the respective key asset that describes connection patterns between the respective key asset and at least one host of the other hosts that communicates with the respective key asset, generating a corresponding dataspace representation of the connection patterns between the respective key asset and the at least one host on the network, the corresponding dataspace representation comprising at least one feature of the connection patterns between the respective key asset and the at least one host, and clustering the respective dataspace representation based on the at least one feature of the connection patterns; identifying metadata for the respective key asset that describes connection patterns between the respective key asset and at least one host of the other hosts that communicates with the respective key asset, generating a corresponding dataspace representation of the connection patterns between the respective key asset and the at least one host on the network, the corresponding dataspace representation comprising at least one feature of the connection patterns between the respective key asset and the at least one host, and clustering the respective dataspace representation based on the at least one feature of the connection patterns; analyzing behaviors in the network relative to the predictive model to determine if respective behaviors are abnormal based on deviation from the predictive model; and generating a threat report when an abnormal behavior is identified.