ProtocolWatch: Discovering the APT