SBIR PHASE I: DERIVING EVENT MODELS, CLASSIFICATION HEURISTICS AND HIGH LEVEL SEMANTICS USING NETWORK TRAFFIC DATA