Methods, systems, and computer program products extracting network behavioral metrics and tracking network behavioral changes

A system for extracting a communication network behavioral metric based on relevancy of the metric to network, comprising:

• a processor;
• and
• a memory coupled to the processor and having computer readable program code stored therein, the computer readable program code comprising:
• a Network Behavior Anomaly Detection (NBAD) module that is configured to measure a network behavior quantitatively over a period of time to obtain quantitative measurements, identify a network metric x that is defined as a random variable that represents the quantitative measurements, select a network feature, generate a metric disintegration model for the network metric x comprising at least one normal behavior probability distribution function for the metric x for each value of the network feature, respectively, and at least one abnormal behavior probability distribution function for the metric x for each value of the network feature, respectively, increase a number of the values of the metric x that indicates normal network behavior and/or abnormal network behavior based on the metric disintegration model, and select the network metric x as a behavioral metric based on a relevancy η of the network metric x to the network behavior;
• wherein the relevancy η is given as follows:
• η
• =
• 
• Φ
• sn
• 
• +
• 
• Φ
• sa
• 
• 
• Φ
• 
• Φ is a sample space of all possible values of x;
• Φsn is a subset of 101 based on the values of x that indicates normal network behavior;
• Φsa is a subset of Φ based on the values of x that indicates abnormal network behavior.