1. A method to profile event sequences, comprising: creating a mixture model stored on a non-transitory machine readable storage medium that simultaneously characterizes event pattern and time information; estimating parameters for the mixture model; applying the mixture model to profile event sequences in computer networks, wherein the mixture model characterizes at least two behaviour aspects including TCP SYN/FIN/RST dataset; and displaying transition delay and rate parameters by thickness and scattering of corresponding edge(s) wherein the rate parameters and edge(s) are shown in a graph.