System and method for real-time tuning of inference systems

A system for real-time tuning of an inference system based on traffic data, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• periodically receive traffic data collected by a plurality of collectors deployed in a network;
• determine at least a normalized variance of a current sample of the received traffic data;
• estimate, based in part on the normalized variance, a standard deviation of the received traffic data and a fading coefficient of a baseline filter;
• determine a current baseline value based on a previous baseline value, the fading coefficient, and the current sample of the traffic data;
• and
• dynamically set at least one membership function of the inference system based in part on the current baseline value and the standard deviation.

A method for detecting abnormal behavior in a network, comprising:

• periodically receiving traffic data collected by a plurality of collectors deployed in a network;
• tuning, in real-time, at least one membership function of an inference system based on the received traffic data, wherein the tuning is based on a baseline value and a standard deviation of the received traffic data;
• and
• evaluating the received traffic data using the at least one membership function to detect abnormal behavior in the received traffic data.