Patent ID: 8078710

Claim:
A method of monitoring computer network activity comprising: reporting a selected network activity by a plurality of remote devices using a frequency moment F p determined in accordance with F p =Σ i m i p where p represents an order of the frequency moment of 0, 1, or 2, i representing the selected network activity, and m i representing a dataset comprising a frequency associated with the selected network activity i from the plurality of remote devices; and providing a notification in response to F p ≧τ, where τ is a threshold value in response to the order of the frequency moment being 2, the frequency moment F 2 being calculated in two phases of rounds, sketch algorithms being calculated to determine an estimate of a current norm of vectors, the plurality of remote devices sending a bit to a coordinator in response to a local vector exceeding a pre-determined bit threshold, the sketches being collected from each of the plurality of remote devices in response to receiving a pre-determined number of bits; causing the estimate of the current frequency moment F 2 to exceed a pre-determined fraction of a global threshold in response to a summation of the sketches, dividing each round into sub-rounds, where each sub-round is completed on the receipt of a pre-determined threshold of a number of bits; transmitting an approximate sketch to the coordinator on the completion of each sub-round; initiating a new sub-round in response to the approximate sketch being less than a pre-defined threshold; changing an output value of the coordinator; and terminating the algorithm in response to the approximate sketch being equal to or exceeding the pre-defined threshold.