System for monitoring computer systems and alerting users of faults

A method of adaptively monitoring a computer network the method comprising:

• providing a computer network that includes a plurality of associated network components and a plurality of terminals connected thereto, the pluralities of network components and terminals configured to run a plurality of application programs at least one of which is configured to perform one or more user initiated activities, the execution of each activity generating a data stream;
• detecting opcodes in one or more data streams resulting from the execution of the one or more activities multiple times, each opcode indicating that a unique operation of a specific user driven activity has been executed by an application;
• providing one or more activity signatures each usable to detect that a specific activity has been performed;
• detecting, using the one or more activity signatures, one or more baselined attributes of one or more user initiated activities of the two or more of the network components and/or terminals;
• measuring, after the detecting, one or more of the same baselined attributes of the two or more network components and/or terminals, each baselined attribute defined by its own signature that may extend beyond an associated activity signature;
• grouping network components and/or terminals into a plurality of subsets thereof based on (i) the measured attribute values and (ii) the identifying characteristics so as to yield group descriptions, each group description describing a group of the network components and/or terminals whose members share related characteristics in the measured baselined attribute values, the yielded descriptions being monitoring profiles;
• and
• using the monitoring profiles as identifiable groups of network components and/or terminals to detect abnormal behavior of a member or members of the yielded groups by comparing the measured baselined values against expected baselined values in real time.

A system for adaptively monitoring a computer network, the system comprising:

• a plurality of associated network components and a plurality of terminals connected thereto, the pluralities of network components and terminals configured to run a plurality of application programs at least one of which is configured to perform one or more user initiated activities, two or more of the network components and/or terminals being associated with one or more identifying attributes, each identifying attribute being a value that can be determined at a given time for any network component or terminal;
• a storage section that provides one or more activity signatures each usable to detect that a specific activity has been performed;
• a detecting section that detects, using the one or more activity signatures, one or more baselined attributes of one or more user initiated activities of the two or more of the network components and/or terminals, each baselined attribute being defined by its own signature that may extend beyond an associated activity signature;
• a measuring section that measures, after the detecting, one or more of the same baselined attribute values of the two or more network components and/or terminals;
• and
• a logic section that groups network components and/or terminals into a plurality of subsets thereof based on the measured attribute values so as to yield group descriptions, each group description describing a group of the network components and/or terminals whose members share related characteristics in the measured baselined attribute values, the yielded descriptions being monitoring profiles that are usable to detect abnormal behavior of a member or members of the described group.

A system for adaptively monitoring a computer network, the system comprising:

• a plurality of associated network components and a plurality of terminals connected thereto, the pluralities of network components and terminals configured to run a plurality of application programs at least one of which is configured to perform one or more user initiated activities, the execution of each activity generating a data stream;
• a first detecting section that detects opcodes in one or more data streams resulting from the execution of the one or more activities multiple times, each opcode indicating that a unique operation of a specific user driven activity has been executed by an application;
• a storage section that provides one or more activity signatures each usable to detect that a specific activity has been performed;
• a second detecting section that detects, using the one or more activity signatures, one or more baselined attributes of one or more user initiated activities of the two or more of the network components and/or terminals;
• a measuring section that measures, after the detecting, one or more of the same baselined attributes of the two or more network components and/or terminals, each baselined attribute defined by its own signature that may extend beyond an associated activity signature;
• a logic section that groups network components and/or terminals into a plurality of subsets thereof based on (i) the measured attribute values and (ii) the identifying characteristics so as to yield group descriptions, each group description describing a group of the network components and/or terminals whose members share related characteristics in the measured baselined attribute values, the yielded descriptions being monitoring profiles;
• and
• a monitoring section that used the monitoring profiles as identifiable groups of network components and/or terminals to detect abnormal behavior of a member or members of the yielded groups by comparing the measured baselined values against expected baselined values in real time.