1. A network intrusion visualization system comprising: a computer coupled to a network and adapted to receive data from the network, the computer including a nontransitory computer readable medium having stored thereon software instructions for programming the computer to provide a graphical visualization of monitored network activity, the software instructions, when executed by the computer, cause the computer to perform operations including: applying a grammar having a plurality of motifs to a network activity data sample to determine a measure of similarity between the data sample and each of a plurality of models representing different network activity behaviors associated with the grammar; characterizing the data sample based on the measure of similarity, including mapping a normalized difference value for each motif of each grammar to generate a plurality of statistical features; generating a plurality of intelligent icons, each icon corresponding to one of the models and having a respective plurality of graphical representations each corresponding to a different statistical feature representing the normalized difference value of a respective one of the motifs for that model; and displaying the intelligent icons and the respective plurality of graphical representations on a display device coupled to the computer.