Abstract: Embodiments encompassing methods and systems for detecting abnormal digital traffic are disclosed. The method comprises the steps of assigning characterizations of network behaviors according to knowledge nodes and calculating a confidence value based on the characterizations from at least one knowledge node and on weighting factors associated with the knowledge nodes. The knowledge nodes comprise a characterization model based on prior network information. At least one of the knowledge nodes should not be based on fixed thresholds or signatures. The confidence value comprises a quantification of the degree of confidence that the network behaviors constitute abnormal network traffic. The system comprises sensors to detect network events, a program on a computer-readable medium, and a processing device to execute the program,.wherein a network behavior comprises at least one network event.