Patent ID: 8079083

Claim:
A method for storing network traffic, comprising: using at least one processor to monitor network traffic; determining if the network traffic satisfies a first criterion, wherein determining if the network traffic satisfies a first criterion includes: identifying a plurality of probabilities by applying the network traffic to a state graph that comprises a plurality of states, wherein each of the plurality of probabilities indicates a likelihood that the network traffic is associated with a security event and each of the plurality of probabilities is associated with a corresponding one of the plurality of states; combining the plurality of probabilities to generate a combined probability that indicates the likelihood that the network traffic is associated with the security event, wherein combining the plurality of probabilities comprises summing the plurality of probabilities; and determining whether the combined probability exceeds a predetermined threshold; storing the network traffic in a first storage location until it is determined that the first criterion has been satisfied; and storing, in a second storage location, the network traffic stored in the first storage location and at least subsequent network traffic based on a determination that the first criterion has been satisfied and even though a second criterion corresponding to the security event has not been satisfied and the security event has not yet occurred, wherein the network traffic with a highest combined probability of resulting in the security event in the first storage location is stored first in the second storage location.