Tencent Cloud's Advanced Threat Analysis System (NTA) collects enterprise network boundary traffic through mirroring, combines Tencent's massive security data accumulated over the years, and uses data models, security models, and perception algorithm models to identify network attacks and advanced threats (APTs). At the same time, the original traffic of event alarms is retained to facilitate post-event traceability, which can greatly improve the threat awareness capability in the cloud environment.