Assigning and representing security risks on a computer network

A system for processing network data that consists of at least two devices where at least one of the devices is sending data over a physical or wireless connection to the other, the system comprising:

• a data collection device for collecting a stream of flow objects from a plurality of sensors coupled to the data network, wherein the stream of flow objects consists of a finite dimensional nonlinear system;
• a preprocessing unit containing at least an analysis unit for decomposing the stream of flow objects into components that are at least one of (a) oscillating, (b) exponentially growing, (c) exponentially decaying, (d) mean, and (e) stochastic,
• an analysis unit for sorting the components into categories including anomalous known and anomalous unknown, wherein the anomalous known category is indicative of anomalous behavior in the corresponding flow objects having a known cause, and the anomalous unknown category is indicative of anomalous behavior in the corresponding flow objects having an unknown cause;
• and
• a postprocessing unit for:
• creating arisk level indicator for each of the flow objects from at least one of the anomalous known behavior and anomalous unknown behavior of each of the flow objects.

A method of creating risk level indicators on a computer network using a programmed data processing apparatus, the programmed data processing apparatus comprising a processor and memory, the method comprising the processor performing steps according to a program including:

• creating a system baseline comprising:
• collecting a first plurality of traffic matrix data over a first time period;
• aggregating the first plurality of traffic matrix data over a specified time interval into first aggregated data;
• creating a first representation of the first aggregated data;
• computing a first residual by comparing the first representation and the first aggregated data;
• creating the system baseline out of the first representation and the first residual, wherein the system baseline categorizes each of the traffic matrix data of the first plurality of traffic matrix data as one of anomalous known or anomalous unknown;
• creating a sample baseline comprising:
• collecting a second plurality of traffic matrix data over a second time period;
• aggregating the second plurality of traffic matrix data over a specified time interval into second aggregated data;
• creating a second representation of the second aggregated data;
• computing a second residual by comparing the second representation and the second aggregated data;
• creating a second data representation out of the second representation and the second residual, wherein the sample baseline categorizes each of the traffic matrix data of the second plurality of traffic matrix data as one of anomalous known or anomalous unknown;
• computing a difference of the sample baseline and the system baseline;
• based on the difference between the system baseline and the sample baseline, creating a risk level indicator for each of the first and second plurality of traffic matrix data over the first and second time period.