Method and apparatus for monitoring functions of distributed data
First Claim
1. A method of monitoring computer network activity comprising:
- determining a first phase estimate of a second order frequency moment corresponding to activity associated with a plurality of remote computer network devices, the first phase estimate being determined by calculating a first sum of estimates of first frequency vectors received from the plurality of remote computer network devices, the first phase estimate determined in response to receiving a first quantity of bits from the plurality of remote computer network devices, the first quantity of bits being received from the plurality of remote computer network devices in response to a first activity threshold being satisfied, the first activity threshold being associated with the activity associated with the plurality of remote computer network devices;
determining a second phase estimate of the second order frequency moment, the second phase estimate being determined by calculating a second sum of estimates of second frequency vectors received from the plurality of remote computer network devices, the second phase estimate determined in response to receiving a second quantity of bits from the plurality of remote computer network devices, the second quantity of bits being received in response to a second activity threshold being satisfied, the second activity threshold being associated with the activity associated with the plurality of remote computer network devices, the second phase estimate being determined in response to the first phase estimate exceeding a pre-determined fraction of a global threshold; and
providing an alarm in response to the second order frequency moment exceeding the global threshold.
1 Assignment
0 Petitions
Accused Products
Abstract
A method and system of monitoring computer network activity including determining a first phase frequency estimate, associated with a first frequency vector, determined in response to receiving first bits from a first plurality of remote computer network devices. The first bits received from the first plurality of remote devices in response to satisfying a first activity threshold. Also, determining a second phase frequency estimate associated with a second frequency vector and determined in response to receiving second bits from a second plurality of remote devices. The second bits received from the second plurality of remote devices in response to a second activity threshold being satisfied. The second phase frequency estimate determined in response to the first phase frequency estimate exceeding a global threshold. Further, providing a frequency moment Fp in response to the second phase frequency estimate exceeding a refined threshold.
-
Citations
19 Claims
-
1. A method of monitoring computer network activity comprising:
-
determining a first phase estimate of a second order frequency moment corresponding to activity associated with a plurality of remote computer network devices, the first phase estimate being determined by calculating a first sum of estimates of first frequency vectors received from the plurality of remote computer network devices, the first phase estimate determined in response to receiving a first quantity of bits from the plurality of remote computer network devices, the first quantity of bits being received from the plurality of remote computer network devices in response to a first activity threshold being satisfied, the first activity threshold being associated with the activity associated with the plurality of remote computer network devices; determining a second phase estimate of the second order frequency moment, the second phase estimate being determined by calculating a second sum of estimates of second frequency vectors received from the plurality of remote computer network devices, the second phase estimate determined in response to receiving a second quantity of bits from the plurality of remote computer network devices, the second quantity of bits being received in response to a second activity threshold being satisfied, the second activity threshold being associated with the activity associated with the plurality of remote computer network devices, the second phase estimate being determined in response to the first phase estimate exceeding a pre-determined fraction of a global threshold; and providing an alarm in response to the second order frequency moment exceeding the global threshold. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A non-transitory computer-readable storage medium storing instructions that, when executed by a processing device, cause the processing device to provide an alarm associated with a computer network activity by performing a computer process comprising:
-
determining a first phase estimate of a second order frequency moment corresponding to activity associated with a plurality of remote computer network devices, the first phase estimate being determined by calculating a first sum of estimates of first frequency vectors received from the plurality of remote computer network devices, the first phase estimate determined in response to receiving a first quantity of bits from the plurality of remote computer network devices, the first quantity of bits being received from the plurality of remote computer network devices in response to a first activity threshold being satisfied, the first activity threshold being associated with the activity associated with the plurality of remote computer network devices; determining a second phase estimate of the second order frequency moment, the second phase estimate being determined by calculating a second sum of estimates of second frequency vectors received from the plurality of remote computer network devices, the second phase estimate determined in response to receiving a second quantity of bits from the plurality of remote computer network devices, the second quantity of bits being received in response to a second activity threshold being satisfied, the second activity threshold being associated with the activity associated with the plurality of remote computer network devices, the second phase estimate being determined in response to the first phase estimate exceeding a pre-determined fraction of a global threshold; and providing an alarm in response to the second order frequency moment exceeding the global threshold. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. A system to monitor computer network activity, the system comprising:
-
a user interface; a processing device operatively coupled to the user interface and a computer network the computer network including remote computer network devices; and a computer-readable storage medium storing instructions that, when executed by the processing device, cause the processing device to provide an alarm associated with a computer network activity by performing a computer process comprising; determining a first phase estimate of a second order frequency moment corresponding to activity associated with a plurality of remote computer network devices, the first phase estimate determined in response to receiving a first quantity of bits from the plurality of remote computer network devices, the first quantity of bits being received from the plurality of remote computer network devices in response to a first activity threshold being satisfied, the first activity threshold being associated with the activity associated with the plurality of remote computer network devices, the first phase estimate being determined by summing sketches of first frequency vectors received from the plurality of remote computer network devices; determining a second phase estimate of the second order frequency moment, the second phase estimate being determined by summing sketches of second frequency vectors received from the plurality of remote computer network devices, the second phase estimate determined in response to receiving a second quantity of bits from the plurality of remote computer network devices, the second quantity of bits being received in response to a second activity threshold being satisfied, the second activity threshold being associated with the activity associated with the plurality of remote computer network devices, the second phase estimate being determined in response to the first phase estimate exceeding a pre-determined fraction of a global threshold; and providing an alarm in response to the second order frequency moment exceeding the global threshold. - View Dependent Claims (16, 17, 18, 19)
-
Specification