Symptom detection using behavior probability density, network monitoring of multiple observation value types, and network monitoring using orthogonal profiling dimensions

A method for monitoring network activity, including steps of maintaining, by a monitoring device, a first data structure including information regarding historical activity of message traffic between two or more nodes in a network, said historical activity of the network represents a behavior of that network over a first time duration having a first starting time and a first ending time, said first data structure including a first histogram of a first set of counts of values of network traffic elements in a first set of mutually exclusive ranges thereof, said first histogram defining a first probability density function of first results of a first crosspoint of mutually exclusive ranges of values of at least a first type of observable value and a second first type of observable value, wherein the information regarding activity of message traffic in a network is maintained only for traffic relating to source and destination pairs in the network, and only for traffic relating to nodes in the network, for which the information regarding activity of message traffic in a network meets or exceeds a selected activity threshold;

• maintaining a second data structure including emergent activity of the network, wherein said emergent activity represents a behavior of that network over a second time duration, different from said first time duration, having a second starting time and a second ending time, said second starting time being more recent than said first starting time, said second data structure including a second histogram of a second set of counts of values of network traffic elements in a second set of mutually exclusive ranges thereof, said second histogram defining a second probability density function of second results of a second crosspoint of mutually exclusive ranges of values, each second result of the second crosspoint including said plurality of observable parameters and including counts of values of said observable parameters as in a corresponding said first result of the first crosspoint, said second probability density function being representative of said emergent activity for each distinguished value of each of that plurality of observable parameters;
• adjusting content of said first data structure in response to the information regarding emergent activity of that network;
• comparing a set of recent activity of the network, said recent activity of said network being distinguished from said historical activity and from said emergent activity, wherein said recent activity of that network represents a behavior of that network over a third time duration, different from said first time duration and said second time duration, having a third starting time and a third ending time, said third starting time being more recent than said first starting time, with a portion of said first data structure representing a particular one of said first results of the first crosspoint, said particular one of said first results of said first crosspoint being representative of said recent activity;
• and distinguishing, in response to a result of comparing between whether said recent network activity and at least one of historical network activity or emergent network activity is within the range of approved activity.

A method for monitoring network activity, including steps of maintaining, by a monitoring device, a first data structure including information regarding historical activity of message traffic between two or more nodes in a network, wherein said historical activity of that network represents a behavior of the network over a first time duration having a first starting time and a first ending time, a first data structure including a first histogram of a first set of counts of values of network traffic elements in a first set of mutually exclusive ranges thereof, said first histogram defining a first probability density function of first results of a first crosspoint of mutually exclusive ranges of values of observable values for multiple profile dimensions;

• restricting the information regarding activity of message traffic to only those ones of those first results of the first crosspoint that have sufficient information associated therewith, wherein said sufficient information meets or exceeds a selected activity threshold;
• maintaining a second data structure including emergent activity of the network, wherein said emergent activity represents a behavior of that network over a second time duration, different from said first time duration, having a second starting time and a second ending time, said second starting time being more recent than said first starting time, said second data structure including a second histogram of a second set of counts of values of network traffic elements in a second set of mutually exclusive ranges thereof, said second histogram defining a second probability density function of second results of a second crosspoint of mutually exclusive ranges of values, each second result of the second crosspoint including said plurality of observable parameters and including counts of values of said observable parameters as in a corresponding said first result of the first crosspoint, said second probability density function being representative of said emergent activity for each distinguished value of each of that plurality of observable parameters;
• adjusting content of said first data structure in response to the information regarding emergent activity of that network;
• comparing a set of recent activity of the network, said recent activity of said network being distinguished from said historical activity and from said emergent activity, wherein said recent activity of that network represents a behavior of that network over a third time duration, different from said first time duration and said second time duration, having a third starting time and a third ending time, said third starting time being more recent than said first starting time, with a portion of said first data structure representing a particular one of said first results of the first crosspoint, said particular one of said first results of said first crosspoint being representative of said recent activity;
• and distinguishing, in response to a result of comparing between whether said recent network activity and at least one of historical network activity or emergent network activity is within the range of approved activity.

A method of operating a network monitoring device, including steps of maintaining, by said network monitoring device, a first data structure defining a first probability density function of historical activity of message traffic between two or more nodes of the network, including a first histogram of first results between a first starting time and a first ending time of a first set of crosspoints of plurality of distinguished values of observable parameters of network traffic elements, the first histogram including a first set of mutually exclusive ranges of those observable parameters;

• maintaining, by said network monitoring device, a second data structure defining a second probability density function of emergent activity of message traffic between two or more nodes of the network, including a second histogram of second results between a second starting time and a second ending time of a second set of crosspoints of plurality of distinguished values of observable parameters of network traffic elements, the second histogram including a second set of mutually exclusive ranges of those observable parameters;
• maintaining a second data structure including emergent activity of the network, wherein said emergent activity represents a behavior of that network over a second time duration, different from said first time duration, having a second starting time and a second ending time, said second starting time being more recent than said first starting time, said second data structure including a second histogram of a second set of counts of values of network traffic elements in a second set of mutually exclusive ranges thereof, said second histogram defining a second probability density function of second results of a second crosspoint of mutually exclusive ranges of values, each second result of the second crosspoint including said plurality of observable parameters and including counts of values of said observable parameters as in a corresponding said first result of the first crosspoint, said second probability density function being representative of said emergent activity for each distinguished value of each of that plurality of observable parameters;
• adjusting content of said first data structure in response to the second data structure;
• comparing a set of recent network activity having a third starting time and a third ending time, the third starting time being more recent than the first starting time and the second starting time and the third ending time being more recent than the first ending time and the second ending time, with a portion of said first data structure;
• distinguishing, in response to a result of those steps of comparing, between the recent network activity and at least one of historical network activity or emergent network activity.