Input data is obtained and converted into a graph. Based on the converted input data, a time series of snapshot graphs is generated by selecting edges whose timestamps are in a given time window for each of a plurality of time windows, each edge having a corresponding attribute. Internal flow probabilities are computed for each snapshot graph of the time series of snapshot graphs and a system is controlled based on the internal flow probabilities.