A system for reconstructing network activity, the system comprising: one or more processors; and one or more memory devices that store program code configured to be executed by the one or more processors, the program code comprising: a network activity monitor configured to monitor network activity of a plurality of network entities; a feature determiner configured to obtain a set of features for each network entity (110, 112, 114) in the plurality of network entities based on the monitoring, wherein said features relate to a type, frequency and/or volume of network activity; a vertex determiner configured to determine a number of vertices to describe the sets of features in a multidimensional space; a usage pattern assignor configured to assign a different usage pattern to each of the vertices, wherein the assigned usage patterns represent classes or categories of network activity; a network activity reconstructor configured to obtain at least some of the features in the set of features for a particular network entity (110, 112, 114), and to represent the particular network entity (110, 112, 114) as a weighted combination of the usage patterns based on the at least some of the features in the set of features for the particular network entity (110, 112, 114); and a network modifier configured to alter at least one aspect of the network based at least on the representation of the particular network entity (110, 112, 114). one or more processors; and one or more memory devices that store program code configured to be executed by the one or more processors, the program code comprising: a network activity monitor configured to monitor network activity of a plurality of network entities; a feature determiner configured to obtain a set of features for each network entity (110, 112, 114) in the plurality of network entities based on the monitoring, wherein said features relate to a type, frequency and/or volume of network activity; a vertex determiner configured to determine a number of vertices to describe the sets of features in a multidimensional space; a usage pattern assignor configured to assign a different usage pattern to each of the vertices, wherein the assigned usage patterns represent classes or categories of network activity; a network activity reconstructor configured to obtain at least some of the features in the set of features for a particular network entity (110, 112, 114), and to represent the particular network entity (110, 112, 114) as a weighted combination of the usage patterns based on the at least some of the features in the set of features for the particular network entity (110, 112, 114); and a network modifier configured to alter at least one aspect of the network based at least on the representation of the particular network entity (110, 112, 114). a network activity monitor configured to monitor network activity of a plurality of network entities; a feature determiner configured to obtain a set of features for each network entity (110, 112, 114) in the plurality of network entities based on the monitoring, wherein said features relate to a type, frequency and/or volume of network activity; a vertex determiner configured to determine a number of vertices to describe the sets of features in a multidimensional space; a usage pattern assignor configured to assign a different usage pattern to each of the vertices, wherein the assigned usage patterns represent classes or categories of network activity; a network activity reconstructor configured to obtain at least some of the features in the set of features for a particular network entity (110, 112, 114), and to represent the particular network entity (110, 112, 114) as a weighted combination of the usage patterns based on the at least some of the features in the set of features for the particular network entity (110, 112, 114); and a network modifier configured to alter at least one aspect of the network based at least on the representation of the particular network entity (110, 112, 114).