1. A method for detecting abnormal network traffic comprising: assigning characterizations of-network behaviors according to knowledge nodes, said knowledge nodes comprising a characterization model based on prior network information, wherein at least one knowledge node is not based on fixed thresholds or signatures; and calculating a confidence value based on the characterizations from at least one knowledge node and on weighting factors associated with the knowledge nodes, wherein the confidence value comprises a quantification of the degree of confidence that the network behaviors constitute abnormal network traffic.