Abstract: Methods and apparatus for monitoring and capturing network activities and producing network activity reports at predetermined, regular intervals are provided. Embodiments comprise capturing data passing through a network, organizing the data into flows between pairs of unique IP addresses, analyzing the data for pertinent information based on system and user-specified parameters, collecting and storing the information, and detecting potential security threats by identifying suspicious internet traffic. The information is collated and processed to identify an activity for each flow and produce an aggregate report at a user-specified cycle. The aggregate report is then sent to a user without user intervention. The activity for each flow may be identified through a packet data translation engine, based on keyword dictionaries and/or predictive logic.