Systems and methods for automatic profiling of network event sequences

1. A method to profile event sequences, comprising:

creating a mixture model stored on a non-transitory machine readable storage medium that simultaneously characterizes event pattern and time information;

estimating parameters for the mixture model;

applying the mixture model to profile event sequences in computer networks, wherein the mixture model characterizes at least two behaviour aspects including TCP SYN/FIN/RST dataset; and

displaying transition delay and rate parameters by thickness and scattering of corresponding edge(s) wherein the rate parameters and edge(s) are shown in a graph.

2. The method of claim 1 , wherein the mixture model comprises multiple first order Markov chains whose transitions have two parameters: transition probability and transition rate.

3. The method of claim 1 , comprising adding constraints to the mixture model by using domain knowledge.

4. The method of claim 1 , comprising selecting a number of Markov chains in the mixture model by using domain knowledge.

5. The method of claim 1 , comprising estimating parameters using an Expectation Maximization process.

6. The method of claim 1 , comprising visualizing the mixture model.

7. The method of claim 6 , comprising using dotted line to display a transition and setting the ratio of dash length and dash gap in proportion to a function of average transition delay.

8. The method of claim 7 , comprising setting the thickness of each transition in proportion to transition probability.

9. The method of claim 1 , comprising detecting network anomalies based on the mixture model.

10. A system to profile event sequences, comprising:

a mixture model stored on non-transitory machine readable storage medium that simultaneously characterizes event pattern and time information;

a parameter estimator coupled to the mixture model; and

a user interface module to apply the mixture model to profile event sequences in computer networks, wherein the mixture model characterizes at least two behaviour aspects including TCP SYN/FIN/RST dataset, wherein the user interface module displays transition delay and rate parameters by thickness and scattering of corresponding edge(s) and wherein the rate parameters and edge(s) are shown in a graph.

11. The system of claim 10 , wherein the mixture model comprises multiple first order Markov chains whose transitions have two parameters: transition probability and transition rate.

12. The system of claim 10 , comprising adding constraints to the mixture model by using domain knowledge.

13. The system of claim 10 , wherein the mixture model comprises a number of Markov chains selected by using domain knowledge.

14. The system of claim 10 , wherein the parameter estimator comprises an Expectation Maximization process.

15. The system of claim 10 , comprising a graphical user interface (GUI) to visualize the mixture model.

16. The system of claim 15 , wherein the GUI uses dotted line to display transition and sets the ratio of dash length and dash gap in proportion to a function of average transition delay.

17. The system of claim 15 , wherein the GUI sets the thickness of each transition line in proportion to transition probability.

18. The system of claim 10 , comprising a verifier to detect network anomalies based on the mixture model.