DETECTING TRAFFIC ANOMALIES BASED ON APPLICATION-AWARE ROLLING BASELINE AGGREGATES

1 . A method of detecting anomalies in network traffic, the method comprising:

receiving a plurality of accounting reports from an application assurance device, the accounting reports indicating a metric of network performance;

aggregating the metric from a plurality of accounting reports to determine a plurality of aggregated metrics corresponding to a plurality of intervals;

storing the aggregated metrics in a database in association with the corresponding plurality of intervals;

determining a rolling baseline for a current time period based on metrics of intervals corresponding to a primary partition and a sub-partition;

comparing a metric for a current time period to the rolling baseline; and

determining that an anomaly is occurring if the metric for the current time period differs from the rolling baseline by more than a pre-defined threshold.

2 . The method of claim 1 , wherein the primary partition and the sub-partition are cyclical.

3 . The method of claim 2 , wherein the primary partition is the day of the week and the sub-partition is the interval within the day.

4 . The method of claim 3 , wherein the interval is an hour.

5 . The method of claim 4 , wherein the metric in the accounting reports define a metric for a sub-interval.

6 . The method of claim 1 , wherein the accounting reports indicate a metric of network performance in relation to an application.

7 . The method of claim 1 , wherein the accounting reports indicate a metric of network performance in relation to a subscriber.

8 . The method of claim 1 , wherein the step of determining a rolling baseline for a current time period comprises calculating a weighted average of aggregated metrics for intervals corresponding to the primary partition and sub-partition of the current time period.

9 . The method of claim 8 , wherein the weighted average applies a decayed weighting function to the aggregated metrics according to the age of each interval.

10 . The method of claim 8 , wherein the weighted average includes an operator selected weighted component.

11 . The method of claim 1 , further comprising displaying a graph comparing the rolling baseline to the metrics for a plurality of recent current time periods.

12 . An analysis server for detecting network anomalies comprising:

a router interface configured to receive a plurality of accounting reports from an application assurance device, the accounting reports indicating a metric of network performance;

a non-transitory database configured to store aggregated metrics from a plurality of accounting reports in association with a corresponding plurality of intervals;

a baseline calculator configured to determine a rolling baseline for a current time period based on a subset of the stored aggregated metrics having intervals corresponding to a primary partition and a sub-partition of the current time period; and

an anomaly detector configured to compare a metric for a current time period to the rolling baseline and determine that an anomaly is occurring if the metric for the current time period differs from the rolling baseline by more than a pre-defined threshold.

13 . The analysis server of claim 12 , further comprising an operator interface including a display configured to display a graph comparing the rolling baseline to the metrics for a plurality of recent current time periods.

14 . The analysis server of claim 12 , further comprising a metric aggregator configured to aggregate a plurality of metrics from a plurality of accounting reports and assign a partition and sub-partition to each aggregated metric.

15 . The analysis server of claim 12 , wherein the baseline calculator is configured to determine the rolling baseline for a current time period by calculating a weighted average of aggregated metrics for intervals corresponding to the primary partition and sub-partition of the current time period.

16 . The analysis server of claim 15 , wherein the baseline calculator applies a decayed weighting function to the aggregated metrics according to the age of each interval.

17 . A non-transitory machine-readable storage medium encoded with instructions executable by a processor of an analysis server for detecting anomalies in network traffic, the non-transitory machine-readable storage medium comprising instructions for:

receiving a plurality of accounting reports from an application assurance device, the accounting reports indicating a metric of network performance;

aggregating the metric from a plurality of accounting reports to determine a plurality of aggregated metrics corresponding to a plurality of intervals;

storing the aggregated metrics in a database in association with the corresponding plurality of intervals;

determining a rolling baseline for a current time period based on metrics of intervals corresponding to a primary partition and a sub-partition;

comparing a metric for a current time period to the rolling baseline; and

determining that an anomaly is occurring if the metric for the current time period differs from the rolling baseline by more than a pre-defined threshold.

18 . The non-transitory machine-readable storage medium of claim 17 , wherein the instructions for determining a rolling baseline for a current time period comprise instructions for calculating a weighted average of aggregated metrics for intervals corresponding to the primary partition and sub-partition of the current time period.

19 . The non-transitory machine-readable storage medium of claim 18 , wherein the weighted average applies a decayed weighting function to the aggregated metrics according to the age of each interval.

20 . The non-transitory machine-readable storage medium of claim 17 , wherein the primary partition and the sub-partition are cyclical, the primary partition is the day of the week, he sub-partition is the hour within the day, and the metric in the accounting reports define a metric for a sub-interval.