System and method for analyzing data streams
AssigneeNetScout Systems, Inc.
InventorsDragan Radulovic, Amin Arshad Abdulghani, Ronald George Hiller
Life of this patent
Estimating the term…
Abstract
A system and method operates to analyze a data stream, for example, a stream of download times for accessing information through a computer network. The system and method are capable of identifying abnormalities in the data stream compared to previous data in the data stream. More particularly, the system and method is capable of dynamically analyzing a data stream to detect abrupt, severe abnormalities as well subtle changes that occur over time.
Claims26
A method of identifying unusual behavior in a data stream of data collected from a computer network, comprising:
- receiving data in the data stream, the data relating to performance of at least one of the computer network and at least one computer in the computer network;
- processing the received data;
- generating a plurality of representations of the processed data, wherein each representation is generated from a different length of processed data, at least one of the lengths of data being arbitrarily selected without regard to a natural time cycle;
- and
- comparing each of the representations to historical data to identify unusual behavior.
A method of identifying unusual behavior in a data stream of categorical data, comprising:
- receiving data in the data stream, the data relating to multiple different categories;
- generating a plurality of representations of the data, each representation generated from a different length of the data from the data stream, at least one of the lengths of data being arbitrarily selected without regard to a natural time cycle;
- calculating a plurality of comparison values by comparing each of the representations to historical data of the data stream;
- generating multiple distributions of constructed comparison values using the historical data;
- and
- ranking each of the comparison values based on the distribution of constructed comparison values.
In a method of identifying unusual behavior in a data stream of data collected from a computer network using a representation of historical data of the data stream, a method of updating the representation of historical data of the data stream comprising:
- generating a dynamic weighting factor based on a relative difference between a set of data to be added to the representation of historical data and the representation of historical data;
- and
- combining the data to be added with the representation of historical data using the dynamic weighting factor to generate an updated representation of historical data.
In a system of identifying unusual behavior in a data stream of data collected from a computer network, a method of ranking received data against historical data of the data stream comprising:
- generating a representation of the data to be ranked, by generating a window value based on a predetermined number of data elements;
- and
- comparing the representation of data to be ranked against a representation of historical data to generate a ranking of the data to be ranked.
Dependencies are inferred from the claim text.