1. A computer-implemented method for identifying significant clusters from traffic traversing a communications link, said method comprising: accessing said communication link with a system including a device configured to read headers of a packet; observing a plurality of flows traversing said communication link with said device; grouping together one or more of said plurality of flows into clusters based on said flows having at least one of the same value for the source IP address (srcIP), destination IP address (dstIP), source port (srcPrt), or destination port (dstPrt), assigning a probability value to each of said clusters, wherein said probability value relates to a cluster property; placing each of said clusters into a set of clusters; selecting a probability threshold and an uncertainty threshold; removing one or more of said clusters whose assigned probability value is above said probability threshold, wherein each of the one or more removed clusters is identified as a significant cluster; computing a relative uncertainty value indicating a level of variability or uniformity among the probability values assigned to the clusters that remain in said set of clusters; repeating a series of steps until said relative uncertainty value is equal to or exceeds said uncertainty threshold, wherein said series of steps includes: (1) decreasing said probability threshold, (2) removing one or more of said clusters remaining in said set of cluster whose assigned probability value is above said probability threshold, (3) identifying each of the one or more removed clusters as a significant cluster, (4) re-computing a relative uncertainty value indicating a level of variability or uniformity among the probability values assigned to the clusters that remain in said set of clusters, and (5) comparing said relative uncertainty value to said uncertainty threshold; and assigning said significant clusters to one of a plurality of behavior classes; and generating a profile characterizing a plurality of traffic patterns, wherein said profile associates one or more of said plurality of behavior classes with each of said plurality of traffic patterns and said plurality of traffic patterns includes one or more profiles associated with malicious behavior or with exploit behavior.