Patent ID: 6597777
Filing Date: 2003-07-22
Classification: H04L

Abstract:
A method of detecting an anomaly on a transaction network over which transactions in a plurality of service classes are electronically conducted, the network providing transaction data which includes for each transaction, a service class of the transaction, a start time of the transaction and a duration of the transaction, the method comprising the steps of:determining a binning interval for a service class from past transaction data associated with that particular service class; using that binning interval, deriving a temporal traffic intensity for that particular service class from current transaction data associated with that particular service class, the traffic intensity representing the traffic in the network at a given time within a binning interval; using that binning interval, deriving temporally varying upper and lower transaction intensity thresholds for that particular service class from historical transaction data associated with that service class; comparing, for that particular service class, the traffic intensity derived from the current transaction data with values of the upper and lower thresholds at times corresponding to times associated with the current transaction data; and determining that an anomaly is associated with that particular service class when the comparing step shows that the transaction intensity derived from current transaction data is above the upper threshold or below the lower threshold for longer than a predetermined time.