Method and System for Detecting Network Upgrades

A non-transitory computer readable storage medium storing a set of instructions executable by a processor, the set of instructions being operable to:

• receive a plurality of configuration sessions, each of the configuration sessions comprising a plurality of configuration commands generated by a same user identifier and within a time threshold;
• and
• identify one of the configuration sessions as a network upgrade session, the identifying based on one of A) a rareness of the configuration session, and B) a skewness of the configuration session.

A system, comprising:

• a network recording device storing a data set including a plurality of configuration sessions for a plurality of network devices, each of the configuration sessions comprising a plurality of configuration commands generated by a same user identifier and within a time threshold;
• and
• an analysis device receiving the data set from the network recording device and identifying one of the configuration sessions as a network upgrade session, the identifying based on one of A) a rareness of the configuration session, and B) a skewness of the configuration session.