Presented herein are techniques for detecting cyber-attacks with sonification. A method includes obtaining, at a network security analysis device, a set of features extracted from one or more network traffic flows between a given host in a network and a domain. The set of features are converted to an acoustical waveform representative of the set of features. Audio patterns are detected in the acoustical waveform using acoustical fingerprints and a cyber-attack is identified in the network by identifying an anomalous sequence of the audio patterns.