Patent ID: 7649853

Claim:
A method for identifying an event of network activity associated with a network comprising a plurality of interfaces, the method comprising: providing a first data structure comprising a plurality of coordinate nodes for organizing measurements of the network activity, wherein the plurality of coordinate nodes form a lattice having a plurality of axes, wherein an axis of the plurality of axes comprises a plurality of coordinate units forming a hierarchical scale and corresponding to a plurality of hierarchical attributes of a hierarchy, wherein the plurality of hierarchical attributes represent hierarchical partitioning granularities configured to partition the network for measuring the network activity; using a processor of a computer, partitioning the plurality of interfaces into a plurality of groups based on a Cartesian product of a coordinate node of the plurality of coordinate nodes, wherein the Cartesian product of the coordinate node is based on at least one of the hierarchical partitioning granularities that is associated with the coordinate node; associating the plurality of groups with the coordinate node, wherein the plurality of groups form a measurement configuration of the network activity associated with the coordinate node; using the processor based on the measurement configuration of the network activity associated with the coordinate node, obtaining a series of measurements of the network activity relating to a group of the plurality of groups; representing the series of measurements of the network activity by a vector having a variable cardinality corresponding to a number of measurements in the series; adding the vector to a plurality of vectors in a lattice dictionary constructed based on the plurality of groups associated with the coordinate node; and identifying an event of the network activity based on the lattice dictionary.