Abstract: A method is provided for conducting surveillance on a network. Data is captured on a network for a plurality of aggregated channels. The data is from individuals with network access identifiers that permit the individuals to gain access to the network, or applications on the network. The data is used to construct a plurality of session data streams. The session data streams provide a reconstruction of business activity participated in by the application or the individual with the network. A window of data is read in at least one of the plurality of session data streams to determine deviations. The window of data is tested against at least one filter. The at least one filter detects behavioral changes in the applications or the individuals that have the network access identifiers to access to the network. Defined intervention are taken in response to the deviations.