Text this: Expert knowledge and data analysis for detecting advanced persistent threats