1. A method for detecting abnormal network traffic comprising: providing at least one knowledge node comprising a characterization model utilizing decision-making techniques from engineering statistics based on prior network information and not based on fixed thresholds or signatures; assigning characterizations of network behaviors according to the characterization models of the at least one knowledge nodes; and calculating a confidence value quantifying the degree of confidence that the network behaviors constitute abnormal traffic, the confidence value being based on the characterizations from the at least one knowledge node and on weighting factors associated with the knowledge nodes; wherein said assigning and said calculating are executed by a processing device.