The Hillstone Server Breach Detection System (sBDS) adopts multiple threat detection technologies that include both traditional signature-based technology as well as large-scale threat intelligent data modeling and user behavioral analytics modeling, which provides an ideal solution to detect unknown or 0-day threat attacks, to protect high-value, critical servers and their sensitive data from being leaked or stolen. Together with deep threat hunting analysis capabilities and visibility, Hillstone sBDS provides security admins the effective means to detect IOCs (Indicators of Compromise) events, restore the threat attack kill chain and provide extensive visibility into threat intelligence analysis and mitigations.