Patent ID: 7808916

Claim:
A network server, comprising: a processor; memory storing executable instructions that, when executed by the processor, perform a method for detecting anomalous traffic in a data stream, said method comprising steps of: a) generating a baseline value corresponding to non-anomalous data in the data stream; b) generating a first test value based on current data of the data stream; c) adjusting the baseline value based on the first test value; and d) triggering an anomaly alarm when the first test value varies from the baseline by at least a predetermined value, wherein step a) comprises steps of: i) initializing parameters using the formulas: μ 1 =X 1 S 1 =S 2 = . . . =S N =1 Var 1 =MinSD 2 where N represents a number of intervals per cycle, MinSD>0, and X represents a data point, and ii) generating the baseline by evaluating the formulas: μ i = min ⁡ ( αθ ⁢ X i S i - N + ( 1 - αθ ) ⁢ μ i - 1 , μ i - 1 + λθ ⁢ Var i - 1 ) ⁢ ⁢ S i = max ⁡ ( min ⁡ ( βθ ⁢ X i μ i - 1 + ( 1 - βθ ) ⁢ S i - N , ( 1 + ρθ ) ⁢ S i - N ) , ( 1 - ρθ ) ⁢ S i - N ) ⁢ ⁢ Var i ⁢ = ⁢ ⁢ max ⁡ ( min ( γθ ⁢ ⁢ S i - N ⁡ ( X i S i - N - μ i ) 2 + ⁢ ( 1 - γθ ) ⁢ Var i - 1 , ( 1 + ψθ ) 2 ⁢ Var i - 1 ) , MinSD 2 ) where i represents an interval, θ represents a ramp-up value>=1, α,β,γ,λ,ρ,ψ represent smoothing parameters between zero and 1/θ; wherein one or more of steps b) and c) comprises evaluating the formulas: μ i = min ⁡ ( α ⁢ X i S i - N + ( 1 - α ) ⁢ μ i - 1 , μ i - 1 + λ ⁢ Var i - 1 ) ⁢ ⁢ S i = max ⁡ ( min ⁡ ( β ⁢ X i μ i - 1 + ( 1 - β ) ⁢ S i - N , ( 1 + ρ ) ⁢ S i - N ) , ( 1 - ρ ) ⁢ S i - N ) ⁢ ⁢ Var i ⁢ = ⁢ ⁢ max ⁡ ( min ( γ ⁢ ⁢ S i - N ⁡ ( X i S i - N - μ i ) 2 + ⁢ ( 1 - γ ) ⁢ Var i - 1 , ( 1 + ψ ) 2 ⁢ Var i - 1 ) , MinSD 2 ) wherein step d) comprises evaluating the formulas: D i = X i - S i - N ⁢ μ i - 1 S i - N ⁢ Var i - 1 Z i =[Z i−1 +f ( D i )−δ] + where δ represents a grown stabilization parameter; and wherein step d) further comprises triggering the anomaly alarm when Z i >T and D i >T wherein Di represents a measure of the deviation of Xi from the estimated baseline and Zi represents a cumulative sum of deviations.