A network monitoring system comprising at least one processing device configured to: A. receive a stream of samples, each sample having an associated network delay value that indicates an amount of time data packets associated with the sample are delayed when transmitted between first network device and second network devices coupled to a network; B. define at least one first group of samples, the number of samples included in each group being defined by a window size; C. determine a first network delay characteristic for the respective first groups, each network delay characteristic being based on the network delay values corresponding to the respective samples included in the corresponding group; D. apply a first test to the first network delay characteristic determined for the respective first groups, wherein the first test includes determining whether the first network delay characteristic associated with the corresponding group is below a predetermined threshold value; E. adjust the window size based on a result of the first test associated with the respective first groups, the adjusting of the window size comprises either decreasing the window size in response to a negative determination of the first test or increasing the window size in response to a positive determination of the first test, the negative determination comprising a determination that the network delay characteristic is above the predetermined threshold and the positive determination comprising a determination that the network delay characteristic is below the predetermined threshold; F. using the adjusted window size, define at least one second group of samples, each second group including samples of the stream of samples subsequent to the samples included in the at least one first group; G. determine a second network delay characteristic for the respective second groups; H. apply a second test to the second network delay characteristic determined for the respective second groups, wherein the second test includes determining whether the second network delay characteristic associated with the corresponding group is below the predetermined threshold value; and I. determine whether to generate an alert notification based on a result of the second test. A. receive a stream of samples, each sample having an associated network delay value that indicates an amount of time data packets associated with the sample are delayed when transmitted between first network device and second network devices coupled to a network; B. define at least one first group of samples, the number of samples included in each group being defined by a window size; C. determine a first network delay characteristic for the respective first groups, each network delay characteristic being based on the network delay values corresponding to the respective samples included in the corresponding group; D. apply a first test to the first network delay characteristic determined for the respective first groups, wherein the first test includes determining whether the first network delay characteristic associated with the corresponding group is below a predetermined threshold value; E. adjust the window size based on a result of the first test associated with the respective first groups, the adjusting of the window size comprises either decreasing the window size in response to a negative determination of the first test or increasing the window size in response to a positive determination of the first test, the negative determination comprising a determination that the network delay characteristic is above the predetermined threshold and the positive determination comprising a determination that the network delay characteristic is below the predetermined threshold; F. using the adjusted window size, define at least one second group of samples, each second group including samples of the stream of samples subsequent to the samples included in the at least one first group; G. determine a second network delay characteristic for the respective second groups; H. apply a second test to the second network delay characteristic determined for the respective second groups, wherein the second test includes determining whether the second network delay characteristic associated with the corresponding group is below the predetermined threshold value; and I. determine whether to generate an alert notification based on a result of the second test.