METHOD AND APPARATUS FOR MONITORING FUNCTIONS OF DISTRIBUTED DATA

• US 20120066383A1
• Filed: 11/23/2011
• Published: 03/15/2012
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: AT&T Labs Incorporated (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Cormode, Graham, Yi, Ke
• Granted Patent: US 8,307,080 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/024 by adaptive sampling
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A method and system of monitoring computer network activity including determining a first phase frequency estimate, associated with a first frequency vector, determined in response to receiving first bits from a first plurality of remote computer network devices. The first bits received from the first plurality of remote devices in response to satisfying a first activity threshold. Also, determining a second phase frequency estimate associated with a second frequency vector and determined in response to receiving second bits from a second plurality of remote devices. The second bits received from the second plurality of remote devices in response to a second activity threshold being satisfied. The second phase frequency estimate determined in response to the first phase frequency estimate exceeding a global threshold. Further, providing a frequency moment F_p in response to the second phase frequency estimate exceeding a refined threshold.

Claims

1. A method of monitoring computer network activity comprising:

determining a first phase frequency estimate associated with a first frequency vector, the first frequency vector being associated with a computer network activity, the first phase frequency estimate determined in response to receiving a first quantity of bits from a first plurality of remote computer network devices, the first quantity of bits being received from the first plurality of remote computer network devices in response to a first activity threshold being satisfied, the first activity threshold being associated with the computer network activity,

determining a second phase frequency estimate associated with a second frequency vector, the second phase frequency estimate being associated with the computer network activity, the second phase frequency estimate determined in response to receiving a second quantity of bits from a second plurality of remote computer network devices, the second quantity of bits being received from the second plurality of remote computer network devices in response to a second activity threshold being satisfied, the second activity threshold being associated with the computer network activity, the second phase frequency estimate being determined in response to the first phase frequency estimate exceeding a global threshold; and

providing a frequency moment F_p associated with the computer network activity in response to the second phase frequency estimate exceeding a refined threshold, the refined threshold being different from the global threshold.

2. The method of claim 1, wherein the frequency moment F_p is determined in accordance with:

F_p=Σ

_im^p_i,

wherein p represents an order of the frequency moment F_p, 0≦

p≦

2, m_i represents a dataset including a frequency associated with the computer network activity i, the network activity i being associated with the first and second pluralities of remote computer network devices.

3. The method of claim 1, wherein the first phase frequency estimate is based on a first norm of vectors associated with the first frequency vector, the second phase frequency estimate being based on a second norm of vectors associated with the second frequency vector.

4. The method of claim 1, wherein the computer network activity represents a function of the first and second pluralities of remote computer network devices.

5. The method of claim 1, wherein at least one of the first and second activity thresholds are at least partially generated randomly.

6. The method of claim 1, wherein the first and second activity thresholds are satisfied by individual ones of the first and second pluralities of remote computer network devices.

7. The method of claim 1, wherein the second phase frequency estimate is determined in response to the first phase frequency estimate exceeding a pre-determined fraction of the global estimate, the pre-determined fraction being greater than 1.

8. A non-transitory computer-readable storage medium storing instructions that, when executed by a processing device, cause the processing device to provide a frequency moment F_p associated with a computer network activity by performing a computer process comprising:

determining a first phase frequency estimate associated with a first frequency vector, the first frequency vector being associated with a computer network activity, the first phase frequency estimate determined in response to receiving a first quantity of bits from a first plurality of remote computer network devices, the first quantity of bits being received from the first plurality of remote computer network devices in response to a first activity threshold being satisfied, the first activity threshold being associated with the computer network activity,

determining a second phase frequency estimate associated with a second frequency vector, the second phase frequency estimate being associated with the computer network activity, the second phase frequency estimate determined in response to receiving a second quantity of bits from a second plurality of remote computer network devices, the second quantity of bits being received from the second plurality of remote computer network devices in response to a second activity threshold being satisfied, the second activity threshold being associated with the computer network activity, the second phase frequency estimate being determined in response to the first phase frequency estimate exceeding a global threshold; and

providing a frequency moment F_p associated with the computer network activity in response to the second phase frequency estimate exceeding a refined threshold, the refined threshold being different from the global threshold.

9. The non-transitory computer-readable storage medium according to claim 8, wherein providing the frequency moment F_p further comprises determining the frequency moment F_p in accordance with:

F_p=Σ

_im^p_i,

wherein p represents an order of the frequency moment F_p, 0≦

p≦

2, m_i represents a dataset including a frequency associated with the computer network activity i, the network activity i being associated with the first and second pluralities of remote computer network devices.

10. The non-transitory computer-readable storage medium according to claim 8, wherein determining the first phase frequency estimate is based on a first norm of vectors associated with the first frequency vector, the second phase frequency estimate being based on a second norm of vectors associated with the second frequency vector.

11. The non-transitory computer-readable storage medium according to claim 8, wherein the computer network activity represents a function of the first and second pluralities of remote computer network devices.

12. The non-transitory computer-readable storage medium according to claim 8, wherein at least one of the first and second activity thresholds are at least partially generated randomly.

13. The non-transitory computer-readable storage medium according to claim 8, wherein the first and second activity thresholds are satisfied by individual ones of the first and second pluralities of remote computer network devices.

14. The non-transitory computer-readable storage medium according to claim 8, wherein the second phase frequency estimate is determined in response to the first phase frequency estimate exceeding a pre-determined fraction of the global estimate, the pre-determined fraction being greater than 1.

15. A system to monitor computer network activity, the system comprising:

a user interface;

a processing device operatively coupled to the user interface and a computer network including remote computer network devices; and

a computer-readable storage medium storing instructions that, when executed by the processing device, cause the processing device to provide a frequency moment F_p associated with a computer network activity by performing a computer process comprising;

determining a first phase frequency estimate associated with a first frequency vector, the first frequency vector being associated with a computer network activity on the computer network, the first phase frequency estimate determined in response to receiving a first quantity of bits from a first plurality of the remote computer network devices, the first quantity of bits being received from the first plurality of remote computer network devices in response to a first activity threshold being satisfied, the first activity threshold being associated with the computer network activity,

determining a second phase frequency estimate associated with a second frequency vector, the second phase frequency estimate being associated with the computer network activity, the second phase frequency estimate determined in response to receiving a second quantity of bits from a second plurality of the remote computer network devices, the second quantity of bits being received from the second plurality of remote computer network devices in response to a second activity threshold being satisfied, the second activity threshold being associated with the computer network activity, the second phase frequency estimate being determined in response to the first phase frequency estimate exceeding a pre-determined fraction of a global threshold; and

providing a frequency moment F_p associated with the computer network activity in response to the second phase frequency estimate exceeding a refined threshold, the refined threshold being different from the global threshold.

16. The system as defined by claim 15, wherein providing the frequency moment F_p further comprises determining the frequency moment F_p in accordance with

F_p=Σ

_im^p_i,

wherein p represents an order of the frequency moment F_p, 0≦

p≦

2, m_i represents a dataset including a frequency associated with the computer network activity i, the network activity i being associated with the first and second pluralities of remote computer network devices.

17. The system as defined by claim 15, wherein determining the first phase frequency estimate is based on a first norm of vectors associated with the first frequency vector, determining the second phase frequency estimate being based on a second norm of vectors associated with the second frequency vector.

18. The system as defined by claim 15, wherein the computer network activity represents a function of the first and second pluralities of remote computer network devices.

19. The system as defined by claim 15, wherein at least one of the first and second activity thresholds are at least partially generated randomly.

20. The system as defined by claim 15, wherein the first and second activity thresholds are satisfied by individual ones of the first and second pluralities of remote computer network devices.