Patent ID: 8307080
Filing Date: 2012-11-06
Classification: H04L

Abstract:
1. A method of monitoring computer network activity comprising: determining a first phase estimate of a second order frequency moment corresponding to activity associated with a plurality of remote computer network devices, the first phase estimate being determined by calculating a first sum of estimates of first frequency vectors received from the plurality of remote computer network devices, the first phase estimate determined in response to receiving a first quantity of bits from the plurality of remote computer network devices, the first quantity of bits being received from the plurality of remote computer network devices in response to a first activity threshold being satisfied, the first activity threshold being associated with the activity associated with the plurality of remote computer network devices; determining a second phase estimate of the second order frequency moment, the second phase estimate being determined by calculating a second sum of estimates of second frequency vectors received from the plurality of remote computer network devices, the second phase estimate determined in response to receiving a second quantity of bits from the plurality of remote computer network devices, the second quantity of bits being received in response to a second activity threshold being satisfied, the second activity threshold being associated with the activity associated with the plurality of remote computer network devices, the second phase estimate being determined in response to the first phase estimate exceeding a pre-determined fraction of a global threshold; and providing an alarm in response to the second order frequency moment exceeding the global threshold.