1. A method for constructing and maintaining an activity model, comprising: capturing a first window of input and output data into a computer, the first window of input and output data corresponding to a plurality of input channels and a plurality of output channels on the computer; analyzing by one or more computer processors the collected first window of input and output data to identify statistical relationships among the data, wherein the relationships comprise a determination that receiving a packet at a first input channel of the plurality of input channels on the computer causes a packet to be transmitted from a first output channel of the plurality of output channels on the computer; and generating by the one or more computer processors an activity model from the identified statistical relationships among the first window of data.