A security system for a data network and for terminal devices coupled to the data network, the network comprising a network topology of a plurality of network nodes which are interconnected with each other, the security system being built-up hierarchically and implemented in the data network and comprising at least: - at least one network edge node of the data network which is configured to extract data traffic profile information of passing data traffic within the data network, directly from a wire or from mirroring ports of network data plane nodes, to identify any characteristics of the extracted data traffic profile information, to generate traffic profiles from data traffic within the data network and to forward the generated traffic profiles to at least one first level analysis node wherein the traffic profiles being provided as information tuples wherein the information tuples comprise items in terms of protocol header information and/or data which is addressable in metadata; - the at least one first level analysis node being connected to the at least one network edge node and configured to receive the traffic profiles of the data traffic, to apply a learning algorithm to the traffic profiles, to store the learned traffic profiles locally and to forward at least some of the learned profiles which have become firmly established, to at least one second level analysis node, - the at least one second level analysis node being connected to the at least one first level analysis node and to at least one first logically centralized entity and configured to receive the learned profiles from the at least one first level analysis node; - the at least one first logically centralized entity which is configured to store rules which assign certain traffic profiles to respective actions, respectively, and to distribute, when the at least one second level analysis node receives one of the certain traffic profiles from the at least one first level analysis node, the respective rules to the at least one second level analysis node which is configured to forward the respective rules to the at least one first level analysis node for triggering execution of at least one action assigned to the received one of the certain traffic profiles. - at least one network edge node of the data network which is configured to extract data traffic profile information of passing data traffic within the data network, directly from a wire or from mirroring ports of network data plane nodes, to identify any characteristics of the extracted data traffic profile information, to generate traffic profiles from data traffic within the data network and to forward the generated traffic profiles to at least one first level analysis node wherein the traffic profiles being provided as information tuples wherein the information tuples comprise items in terms of protocol header information and/or data which is addressable in metadata; - the at least one first level analysis node being connected to the at least one network edge node and configured to receive the traffic profiles of the data traffic, to apply a learning algorithm to the traffic profiles, to store the learned traffic profiles locally and to forward at least some of the learned profiles which have become firmly established, to at least one second level analysis node, - the at least one second level analysis node being connected to the at least one first level analysis node and to at least one first logically centralized entity and configured to receive the learned profiles from the at least one first level analysis node; - the at least one first logically centralized entity which is configured to store rules which assign certain traffic profiles to respective actions, respectively, and to distribute, when the at least one second level analysis node receives one of the certain traffic profiles from the at least one first level analysis node, the respective rules to the at least one second level analysis node which is configured to forward the respective rules to the at least one first level analysis node for triggering execution of at least one action assigned to the received one of the certain traffic profiles.