Method and apparatus for detecting service anomalies in transaction-oriented networks

Apparatus for detecting an anomaly on a transaction network over which transactions in a plurality of service classes are electronically conducted, the network providing transaction data which includes for each transaction, a service class of the transaction, a start time of the transaction and a duration of the transaction, the apparatus comprising:

• means for determining a binning interval for a service class from past transaction data associated with that particular service class;
• means for deriving a temporal traffic intensity for that particular service class from current transaction data associated with that particular service class using the determined binning interval, the traffic intensity representing the traffic in the network at a given time within a binning interval;
• means for deriving temporally varying upper and lower transaction intensity thresholds for that particular service class from historical transaction data associated with that service class using the determined binning interval;
• means for comparing, for that particular service class, the traffic intensity derived from the current transaction data with values of the upper and lower thresholds at times corresponding to times associated with the current transaction data;
• and
• means for determining that an anomaly is associated with that particular service class when the means for comparing determines that the transaction intensity derived from current transaction data is above the upper threshold or below the lower threshold for longer than a predetermined time.

A network anomaly detector for detecting an anomaly on a transaction network over which transactions are electronically conducted, the network providing transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the anomaly detector comprising:

• a sampler processor to calculate a binning interval from durations of stored historical transaction data and to use that binning interval to produce as an output a temporal traffic intensity of current transaction data;
• a rule generator processor using the calculated binning interval to produce as outputs temporal upper and lower thresholds of transaction intensity of stored historical transaction data;
• and
• a detector processor to temporally compare the traffic intensity output of the sampler processor and the temporal upper and lower threshold outputs of the rule generator processor and to produce an output when traffic intensity is above the upper threshold or below the lower threshold for longer than a predetermined time.

A computer readable medium storing computer program instructions which are executable on a computer system for a network anomaly detector which detects an anomaly on a transaction network over which transactions in a plurality of service classes are electronically conducted, the network providing transaction data which includes for each transaction, a service class of the transaction, a start time of the transaction and a duration of the transaction, said computer program instructions comprising instructions defining the steps of:

• determining a binning interval for a service class from past transaction data associated with that particular service class;
• using that binning interval, deriving a temporal traffic intensity for that particular service class from current transaction data associated with that particular service class, the traffic intensity representing the traffic in the network at a given time within a binning interval;
• using that binning interval, deriving temporally varying upper and lower transaction intensity thresholds for that particular service class from historical transaction data associated with that service class;
• comparing, for that particular service class, the traffic intensity derived from the current transaction data with values of the upper and lower thresholds at times corresponding to times associated with the current transaction data;
• and
• determining that an anomaly is associated with that particular service class when the comparing step shows that the transaction intensity derived from current transaction data is above the upper threshold or below the lower threshold for longer than a predetermined time.

A method of detecting an anomaly on a transaction network comprising the steps of:

• deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• using the binning interval, deriving a temporally varying upper transaction intensity threshold from the historical transaction data;
• comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the upper transaction intensity threshold derived from the historical transaction data;
• and
• determining that an anomaly is present when the comparing step shows that the transaction intensity derived from the current transaction data is greater than the temporally varying upper transaction intensity threshold for longer than a predetermined time.

A method of detecting an anomaly on a transaction network comprising the steps of:

• deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• using the binning interval, deriving a temporally varying lower transaction intensity threshold from the historical transaction data;
• comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the lower transaction intensity threshold derived from the historical transaction data;
• and
• determining that an anomaly is present when the comparing step shows that the transaction intensity derived from the current transaction data is less than the temporally varying lower traffic intensity threshold for longer than a predetermined time.

A method of detecting an anomaly on a transaction network comprising the steps of:

• deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• using the binning interval, deriving a temporally varying upper transaction intensity threshold and a temporally varying lower transaction intensity threshold from the historical transaction data;
• comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the upper and lower transaction intensity thresholds derived from the historical transaction data;
• and
• determining that an anomaly is present when the comparing step shows that the transaction intensity derived from the current transaction data is greater than the temporally varying upper transaction intensity threshold or less than the temporally varying lower transaction intensity for longer than a predetermined time.

A transaction network anomaly detector comprising:

• means for deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• means for deriving a temporally varying upper transaction intensity threshold from the historical transaction data using the binning interval;
• means for comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the upper transaction intensity threshold derived from the historical transaction data;
• and
• means for determining that an anomaly is present when the means for comparing determines that the transaction intensity derived from the current transaction data is greater than the temporally varying upper transaction intensity threshold for longer than a predetermined time.

A transaction network anomaly detector comprising:

• means for deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• means for deriving a temporally varying lower transaction intensity threshold from the historical transaction data using the binning interval;
• means for comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the lower transaction intensity threshold derived from the historical transaction data;
• and
• means for determining that an anomaly is present when the means for comparing determines that the transaction intensity derived from the current transaction data is less than the temporally varying lower traffic intensity threshold for longer than a predetermined time.

A transaction network anomaly detector comprising:

• means for deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• means for deriving a temporally varying upper transaction intensity threshold and a temporally varying lower transaction intensity threshold from the historical transaction data using the binning interval;
• means for comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the upper and lower transaction intensity thresholds derived from the historical transaction data;
• and
• means for determining that an anomaly is present when the means for comparing determines that the transaction intensity derived from the current transaction data is greater than the temporally varying upper transaction intensity threshold or less than the temporally varying lower transaction intensity for longer than a predetermined time.

A computer readable medium storing computer program instructions which are executable on a computer system for a transaction network anomaly detector, said computer program instructions comprising instructions defining the steps of:

• deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• using the binning interval, deriving a temporally varying upper transaction intensity threshold from the historical transaction data;
• comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the upper transaction intensity threshold derived from the historical transaction data;
• and
• determining that an anomaly is present when the comparing step shows that the transaction intensity derived from the current transaction data is greater than the temporally varying upper transaction intensity threshold for longer than a predetermined time.

A computer readable medium storing computer program instructions which are executable on a computer system for a transaction network anomaly detector, said computer program instructions comprising instructions defining the steps of:

• deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• using the binning interval, deriving a temporally varying lower transaction intensity threshold from the historical transaction data;
• comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the lower transaction intensity , threshold derived from the historical transaction data;
• and
• determining that an anomaly is present when the comparing step shows that the transaction intensity derived from the current transaction data is less than the temporally varying lower traffic intensity threshold for longer than a predetermined time.

A computer readable medium storing computer program instructions which are executable on a computer system for a transaction network anomaly detector, said computer program instructions comprising instructions defining the steps of:

• deriving a temporal traffic intensity function from current real-time transaction data which includes for each transaction, a start time of the transaction and a duration of the transaction, the traffic intensity being determined within successive binning intervals that each have a length that is determined as a function of the durations of transactions in historical transaction data obtained from the network so that a substantially high percentage of transactions in the historical transaction data have a duration less than the binning interval;
• using the binning interval, deriving a temporally varying upper transaction intensity threshold and a temporally varying lower transaction intensity threshold from the historical transaction data;
• comparing at temporally corresponding times the traffic intensity derived from the current real-time transaction data with the upper and lower transaction intensity thresholds derived from the historical transaction data;
• and
• determining that an anomaly is present when the comparing step shows that the transaction intensity derived from the current transaction data is greater than the temporally varying upper transaction intensity threshold or less than the temporally varying lower transaction intensity for longer than a predetermined time.